01 Record

CVE-2026-49849

xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

CriticalPUBLISHEDCNA: GitHub_M

Base score9.1 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

02 Description

xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

Published

2026-08-21 21:14Z4 HR AGO

Last updated

2026-08-21 21:14Z4 HR AGO

Reserved

2026-06-01

Assigning CNA

GitHub_M

Record state

PUBLISHED

Severity

Critical (CVSS 9.1)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

7c267543c2e4dca3636160e77a01fc520f9e11d12fd855bbaacfe3e0747dda63

VendorProductVersionsPlatforms

4xmenxshop= 3.0.3—