---
id: CVE-2026-4337
title: Unrestricted Upload of File in PuMuKIT application
summary: >-
  Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT
  application allows a unauthenticated user to upload any type of file to the
  server, and to any path where the web server user has write permissions. This
  could …
severity: high
cvss: 8.8
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L'
cvssSource: cna
cwe:
  - CWE-434
vendor: PuMuKIT
product: PuMuKIT
affected:
  - PuMuKIT current version
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T11:03:15.829Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-4337'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-upload-file-pumukit-application
tags:
  - cve.org
ingestedAt: '2026-10-27T16:11:59.299Z'
---

## Overview

Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files.

## Affected

- `PuMuKIT current version`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.