CVE-2026-116113 | GouGuOA up to 6.1.2 Api.php chunkUpload file_extension unrestricted upload

SecurityVulns
Yanac

A vulnerability was found in GouGuOA up to 6.1.2. It has been declared as critical. The impacted element is the function chunkUpload of the file app/disk/controller/Api.php. The manipulation of the argument file_extension results in unrestricted upload.

This vulnerability is known as CVE-2026-116113. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More