CVE-2026-113382 | arizu-id fast-tunnel 1.0.0 Plugin Installer backend/api_plugins.php ZipArchive::extractTo plugin_file unrestricted upload

October 20, 2026 Yanac

A vulnerability categorized as critical has been discovered in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Installer. Such manipulation of the argument plugin_file leads to unrestricted upload.

This vulnerability is traded as CVE-2026-113382. The attack may be launched remotely. Furthermore, there is an exploit available.

It is advisable to upgrade the affected component.

The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.VulDB Recent EntriesRead More