PuMuKIT: Unrestricted file upload by unauthenticated users
Summary
PuMuKIT, an open-source video platform, does not restrict the type or destination of uploaded files (CWE-434). An unauthenticated remote attacker can upload any file type to any path the web server user can write to, and can also delete files. The CVSS 4.0 score is 8.8 (High), and the impact depends on the web server configuration and write permissions.
Affected
- PuMuKIT versions prior to 5.0.8, according to the INCIBE advisory
- The CVE record only says "current version"; the affected range has not been confirmed by the vendor
Fixed in
- Unknown. INCIBE reports no solution at this time.
- Version 5.0.8 is the first version outside the stated affected range, but no vendor fix or changelog entry has been confirmed.
Workaround
- Restrict upload endpoints at the reverse proxy or WAF to authenticated or trusted clients, if the deployment allows it.
- Run the web application with write access only to the directories that need it.
- Block script execution in upload and media directories.
- Monitor web-writable paths for new or modified files and keep integrity baselines and backups.
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV (per Strix; the catalogue was not checked directly).
- No public proof of concept found.
Our recommendation
- Inventory all PuMuKIT instances, including those run by partners or hosting providers.
- Confirm the installed version with the vendor or INCIBE and treat versions before 5.0.8 as vulnerable until a fix is confirmed.
- Apply the workarounds above and restrict internet exposure of upload functions.
- Monitor web-writable directories for unexpected files and review logs for upload requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- INCIBE-CERT advisory www.incibe.es
- CVE record mirror (threatint) cve.threatint.com
- Strix CVE details www.strix.ai
- OffSeq threat radar radar.offseq.com
- VulDB entry vuldb.com
- EUVD euvd.enisa.europa.eu
- PuMuKIT project website pumukit.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:15.
Original description (NVD)
Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.