CVE-2026-4337: Unauthenticated Arbitrary File Upload and Deletion in PuMuKIT

Summary

CVE-2026-4337 is an unauthenticated unrestricted file upload vulnerability (CWE-434) in the PuMuKIT application. Any remote user can upload files of any type to any path where the web server user has write permissions, and can potentially delete files. The NVD entry rates it 8.8 (High) under CVSS 4.0.

Technical Analysis

The CWE-434 classification captures the core defect: the application accepts file uploads without restricting file type, and the description indicates the destination path is not confined to a safe upload directory — files can land in “any path where the web server user has write permissions.” That combination turns a routine upload feature into an arbitrary file-write primitive.

The CVSS 4.0 vector confirms how reachable this is: AV:N/AC:L/AT:N/PR:N/UI:N means a network-attached attacker needs no credentials, no user interaction, and faces no meaningful complexity bar. The impact scores — VC:L/VI:H/VA:H — match the description: integrity and availability of the vulnerable system take the biggest hit, because an attacker who can write and delete files as the web server user can alter application code, configuration, or data, and can remove files the service depends on. Confidentiality is scored low, consistent with a write/delete primitive rather than a read primitive.

The notice adds that the flaw “could also allow them to delete files,” making this a dual write-plus-delete primitive. Arbitrary write as the web server user is, in many deployments, one step away from code execution — for example by placing content where the server will execute or serve it — but the advisory does not claim code execution, and details such as the vulnerable endpoint, parameter names, or the exact path-handling flaw are not fully disclosed in the provided sources.

Affected Software and Versions

The affected product is the PuMuKIT application. The provided NVD data does not enumerate affected or fixed versions, and no vendor patch level is stated; consult the INCIBE-CERT advisory referenced below for version specifics.

Impact

Unauthenticated upload of any file type to the server (CWE-434).
Write access to any path where the web server user has write permissions — arbitrary file placement.
Possible deletion of files on the server.
Per CVSS 4.0: high integrity and availability impact on the vulnerable system; low confidentiality impact; low subsequent-system impacts.

Exploitation Scenario

Illustrative scenario derived from the description — the exact endpoint and parameters are not disclosed in the provided sources:

An unauthenticated attacker reaches PuMuKIT’s upload functionality over the network. No credentials or user interaction are required (PR:N/UI:N in the CVSS vector).
Because file type is unrestricted, the attacker supplies a file of their choosing rather than a legitimate file.
Because the destination path is not confined, the upload is directed to a location where the web server user can write — for example a directory the attacker selects via the upload request. The mechanism for that path control is not fully disclosed.
The attacker now holds a file-write primitive as the web server user: they can add or overwrite files within the web server user’s writable scope, and per the advisory they may also delete files.
Consequences depend on deployment: modified application content, corrupted or removed service files, or — where the web server user can write into executable contexts — potential code execution. The advisory itself confirms upload and deletion, not code execution.

Detection and Mitigation

No fixed version or vendor patch is disclosed in the provided data. Interim hardening measures:

Require authentication and authorization on all upload endpoints.
Enforce strict file-type validation (extension and content) and reject unexpected types.
Canonicalize and whitelist the upload destination; never accept client-controlled path components.
Run the web server user with least privilege so its writable scope does not include application code or configuration.
Monitor for unexpected file creation, overwrite, or deletion in web-served directories.

Bug Bounty Angle

This is a high-value pattern for authorized testing: unauthenticated, network-reachable, low attack complexity, and a clear impact path. On permitted PuMuKIT targets, probe upload endpoints for missing type checks and client-controlled destination paths, and prove the primitive safely — write a harmless canary file to a benign writable location and demonstrate deletion only on a canary you own. Avoid destructive payloads; overwriting or deleting production files can breach program rules and cause real damage.

Discovery and Credits: Discovered by David Herrero de la Peña; CVE assigned by INCIBE.

Frequently Asked Questions

What is CVE-2026-4337?

An unauthenticated unrestricted file upload vulnerability (CWE-434) in PuMuKIT. Any remote user can upload any file type to any path writable by the web server user, and may also delete files. CVSS 4.0 severity: 8.8 High.

Which PuMuKIT versions are affected?

The provided NVD data does not list affected or fixed versions. Consult the INCIBE-CERT advisory referenced by NVD for version and patch details.