CVE-2026-6650

CVE-2026-6650 is an unrestricted file upload vulnerability in Z-BlogPHP version 1.7.5, specifically within the App::UnPack function of the ZBA File Handler component located at /zb_users/plugin/AppCentre/app_upload.php. This vulnerability allows attackers to upload files without proper restrictions, potentially leading to unauthorized code execution or system compromise. The vulnerability presents a medium severity risk with a CVSS score of 4.7. It requires network access and can be exploited by authenticated users with high privileges, but demands no user interaction. The impact is limited to confidentiality, integrity, and availability of affected systems, though the consequences could extend beyond the application itself depending on deployment context and file permissions. Exploitation is currently possible, as public exploit code is available and the vulnerability is actively tracked on security advisory lists. However, the vulnerability shows low community attention relative to other CVEs, with an EPSS score indicating minimal prevalence in real-world exploitation attempts at this time. The vendor has not responded to disclosure communications, suggesting patches may not be forthcoming through official channels.