CyberRota Analysis
AI-GeneratedThe ContiNew Admin application lacks proper file-upload permission checks and file-type validation for multipart uploads, enabling authenticated users to upload files with arbitrary extensions. This vulnerability could lead to unauthorized access to sensitive data or execution of malicious files stored in the backend, posing a risk to the integrity and confidentiality of the system. Organizations using ContiNew Admin should prioritize remediation to mitigate potential exploitation by malicious actors.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary files in the storage backend accessible via web server URLs.