{"id":"CVE-2026-50894","title":"easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted fil…","summary":"easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted fil…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-434"],"published":"2026-09-04","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:18:05.577","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50894","references":[{"url":"https://github.com/lilil3333/cve/issues/1","label":"cve@mitre.org"},{"url":"https://github.com/zhongshaofa/easyadmin/","label":"cve@mitre.org"},{"url":"https://github.com/lilil3333/cve/issues/1","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00476,"epssPercentile":0.40305,"ingestedAt":"2026-09-08T20:10:03.168Z","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-09T19:21:03.554926Z"},"slug":"CVE-2026-50894","body":"## Overview\n\neasyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":202692,"id":"CVE-2026-50894","ts":1789402237105,"field":"exploit_available","old":"false","new":"true"},{"seq":201734,"id":"CVE-2026-50894","ts":1789399664295,"field":"cvss","old":null,"new":"9.8"},{"seq":201733,"id":"CVE-2026-50894","ts":1789399664295,"field":"severity","old":"none","new":"critical"},{"seq":200464,"id":"CVE-2026-50894","ts":1789397301827,"field":"cvss","old":"9.8","new":null},{"seq":200463,"id":"CVE-2026-50894","ts":1789397301827,"field":"severity","old":"critical","new":"none"},{"seq":198385,"id":"CVE-2026-50894","ts":1789391878732,"field":"cvss","old":null,"new":"9.8"},{"seq":198384,"id":"CVE-2026-50894","ts":1789391878732,"field":"severity","old":"none","new":"critical"},{"seq":196179,"id":"CVE-2026-50894","ts":1789383532209,"field":"cvss","old":"9.8","new":null},{"seq":196178,"id":"CVE-2026-50894","ts":1789383532209,"field":"severity","old":"critical","new":"none"},{"seq":195108,"id":"CVE-2026-50894","ts":1789380415564,"field":"cvss","old":null,"new":"9.8"},{"seq":195107,"id":"CVE-2026-50894","ts":1789380415564,"field":"severity","old":"none","new":"critical"},{"seq":193895,"id":"CVE-2026-50894","ts":1789378412230,"field":"cvss","old":"9.8","new":null},{"seq":193894,"id":"CVE-2026-50894","ts":1789378412230,"field":"severity","old":"critical","new":"none"},{"seq":192682,"id":"CVE-2026-50894","ts":1789376365492,"field":"cvss","old":null,"new":"9.8"},{"seq":192681,"id":"CVE-2026-50894","ts":1789376365492,"field":"severity","old":"none","new":"critical"},{"seq":191469,"id":"CVE-2026-50894","ts":1789373318213,"field":"cvss","old":"9.8","new":null},{"seq":191468,"id":"CVE-2026-50894","ts":1789373318213,"field":"severity","old":"critical","new":"none"},{"seq":190254,"id":"CVE-2026-50894","ts":1789369251619,"field":"cvss","old":null,"new":"9.8"},{"seq":190253,"id":"CVE-2026-50894","ts":1789369251619,"field":"severity","old":"none","new":"critical"},{"seq":189041,"id":"CVE-2026-50894","ts":1789368196726,"field":"cvss","old":"9.8","new":null},{"seq":189040,"id":"CVE-2026-50894","ts":1789368196726,"field":"severity","old":"critical","new":"none"},{"seq":187824,"id":"CVE-2026-50894","ts":1789365108827,"field":"cvss","old":null,"new":"9.8"},{"seq":187823,"id":"CVE-2026-50894","ts":1789365108827,"field":"severity","old":"none","new":"critical"},{"seq":186611,"id":"CVE-2026-50894","ts":1789363186084,"field":"cvss","old":"9.8","new":null},{"seq":186610,"id":"CVE-2026-50894","ts":1789363186084,"field":"severity","old":"critical","new":"none"},{"seq":185397,"id":"CVE-2026-50894","ts":1789361056013,"field":"cvss","old":null,"new":"9.8"},{"seq":185396,"id":"CVE-2026-50894","ts":1789361056013,"field":"severity","old":"none","new":"critical"},{"seq":184184,"id":"CVE-2026-50894","ts":1789358068784,"field":"cvss","old":"9.8","new":null},{"seq":184183,"id":"CVE-2026-50894","ts":1789358068784,"field":"severity","old":"critical","new":"none"},{"seq":182435,"id":"CVE-2026-50894","ts":1789354183328,"field":"cvss","old":null,"new":"9.8"},{"seq":182434,"id":"CVE-2026-50894","ts":1789354183328,"field":"severity","old":"none","new":"critical"},{"seq":181228,"id":"CVE-2026-50894","ts":1789353052439,"field":"cvss","old":"9.8","new":null},{"seq":181227,"id":"CVE-2026-50894","ts":1789353052439,"field":"severity","old":"critical","new":"none"},{"seq":180021,"id":"CVE-2026-50894","ts":1789350121884,"field":"cvss","old":null,"new":"9.8"},{"seq":180020,"id":"CVE-2026-50894","ts":1789350121884,"field":"severity","old":"none","new":"critical"},{"seq":178814,"id":"CVE-2026-50894","ts":1789348015162,"field":"cvss","old":"9.8","new":null},{"seq":178813,"id":"CVE-2026-50894","ts":1789348015162,"field":"severity","old":"critical","new":"none"},{"seq":177607,"id":"CVE-2026-50894","ts":1789346243747,"field":"cvss","old":null,"new":"9.8"},{"seq":177606,"id":"CVE-2026-50894","ts":1789346243747,"field":"severity","old":"none","new":"critical"},{"seq":176400,"id":"CVE-2026-50894","ts":1789342939569,"field":"cvss","old":"9.8","new":null},{"seq":176399,"id":"CVE-2026-50894","ts":1789342939569,"field":"severity","old":"critical","new":"none"},{"seq":176063,"id":"CVE-2026-50894","ts":1789342384208,"field":"cvss","old":null,"new":"9.8"},{"seq":176062,"id":"CVE-2026-50894","ts":1789342384208,"field":"severity","old":"none","new":"critical"},{"seq":175724,"id":"CVE-2026-50894","ts":1789338551538,"field":"cvss","old":"9.8","new":null},{"seq":175723,"id":"CVE-2026-50894","ts":1789338551538,"field":"severity","old":"critical","new":"none"},{"seq":174519,"id":"CVE-2026-50894","ts":1789334718903,"field":"cvss","old":null,"new":"9.8"},{"seq":174518,"id":"CVE-2026-50894","ts":1789334718903,"field":"severity","old":"none","new":"critical"},{"seq":173314,"id":"CVE-2026-50894","ts":1789333418909,"field":"cvss","old":"9.8","new":null},{"seq":173313,"id":"CVE-2026-50894","ts":1789333418909,"field":"severity","old":"critical","new":"none"},{"seq":172128,"id":"CVE-2026-50894","ts":1789330962490,"field":"cvss","old":null,"new":"9.8"}]}