CVE-2026-2113
MediumPublic exploityuan1994 tpadmin WebUploader preview.php deserialization
Published Feb 7, 2026 · Updated Aug 12, 2026
Key Facts
Routine patching- CVE-2026-2113 is a medium-severity vulnerability (CVSS 5.5 v4) affecting Tpadmin (Tpadmin Project).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 2.4% probability of exploitation in the next 30 days.
- Fixed versions are available, including Tpadmin 1.3.12.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
CVSS v4
5.5
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (30-day exploit likelihood)
2.4%
Higher than 84.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-2113 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A security vulnerability has been detected in yuan1994 tpadmin up to 1.3.12. This affects an unknown part in the library /public/static/admin/lib/webuploader/0.1.5/server/preview.php of the component WebUploader. The manipulation leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| TpadminTpadmin Project | >= 1.3.0 | 1.3.12 |
Patched Releases
Tpadmin
1.3.12
Timeline
Publicly disclosed
Feb 7, 2026
Last updated
Aug 12, 2026
Weakness Type
- CWE-20 Improper Input Validation
- CWE-434 Unrestricted Upload of File with Dangerous Type
- CWE-502 Deserialization of Untrusted Data
References
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2113.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-2113
- advisorySubmit #746795 | https://github.com/yuan1994/tpadmin cms v1.3 RCE
- otherVDB-344688 | CTI Indicators (IOB, IOC, IOA)
- otherVDB-344688 | yuan1994 tpadmin WebUploader preview.php deserialization
FAQ
Common Questions.
A security vulnerability has been detected in yuan1994 tpadmin up to 1.3.12.
Affected: Tpadmin (Tpadmin Project) versions >= 1.3.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Tpadmin 1.3.12.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2026-2113 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo