{"id":"CVE-2026-19383","state":"PUBLISHED","title":"saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload","description":"A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shell_exec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product is published by multiple vendors.","publishedAt":"2026-08-10T01:00:10.437Z","updatedAt":"2026-08-10T16:16:12.624Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["saithink SaiAdmin","saigroup SaiAdmin"],"affected":[{"vendor":"saithink","product":"SaiAdmin","versions":[{"version":"5.0.0","status":"affected"},{"version":"5.0.1","status":"affected"}],"cpes":["cpe:2.3:a:saithink:saiadmin:*:*:*:*:*:*:*:*"],"modules":["Plugin Upload Endpoint"]},{"vendor":"saigroup","product":"SaiAdmin","versions":[{"version":"5.0.0","status":"affected"},{"version":"5.0.1","status":"affected"}],"cpes":["cpe:2.3:a:saigroup:saiadmin:*:*:*:*:*:*:*:*"],"modules":["Plugin Upload Endpoint"]}],"references":["https://vuldb.com/vuln/387276","https://vuldb.com/vuln/387276/cti","https://vuldb.com/cve/CVE-2026-19383","https://vuldb.com/submit/866981","https://github.com/sign9981/CVE/issues/1"],"weaknesses":["CWE-434","CWE-284"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/19xxx/CVE-2026-19383.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-19383","state":"PUBLISHED","datePublished":"2026-08-10T01:00:10.437Z","dateUpdated":"2026-08-10T16:16:12.624Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-08-09T17:25:22.752Z"},"containers":{"cna":{"title":"saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload","descriptions":[{"lang":"en","value":"A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shell_exec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product is published by multiple vendors."}],"affected":[{"vendor":"saithink","product":"SaiAdmin","versions":[{"version":"5.0.0","status":"affected"},{"version":"5.0.1","status":"affected"}],"cpes":["cpe:2.3:a:saithink:saiadmin:*:*:*:*:*:*:*:*"],"modules":["Plugin Upload Endpoint"]},{"vendor":"saigroup","product":"SaiAdmin","versions":[{"version":"5.0.0","status":"affected"},{"version":"5.0.1","status":"affected"}],"cpes":["cpe:2.3:a:saigroup:saiadmin:*:*:*:*:*:*:*:*"],"modules":["Plugin Upload Endpoint"]}],"references":[{"url":"https://vuldb.com/vuln/387276","name":"VDB-387276 | saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/387276/cti","name":"VDB-387276 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-19383","name":"CVE-2026-19383 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/866981","name":"Submit #866981 | saithink saiadmin 5.0.1 Remote Code Execution","tags":["third-party-advisory"]},{"url":"https://github.com/sign9981/CVE/issues/1","tags":["exploit","issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.7,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.7,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5.8,"vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","type":"CWE","lang":"en","description":"Unrestricted Upload"}]},{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"Improper Access Controls"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-08-10T01:00:10.437Z"},"timeline":[{"time":"2026-08-09T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-08-09T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-08-09T19:30:28.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"xiaobu (VulDB User)","type":"reporter"}],"x_generator":["VulDB PVTS v202608"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-10T16:15:32.406059Z","id":"CVE-2026-19383","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-10T16:16:12.624Z"}}]}}}