---
id: CVE-2026-84063
title: >-
  BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of
  file with dangerous type
summary: >-
  BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of
  file with dangerous type. If this vulnerability is exploited, an arbitrary
  file may be uploaded by an attacker who can log in to the product, potentially
  allo…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-434
vendor: 'D-ZERO CO.,LTD.'
product: BurgerEditor
affected:
  - BurgerEditor 3.2.0 through 3.4.0
  - BurgerEditor 2.28.0 through 2.30.0
published: '2026-09-10'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T05:17:11.590'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84063'
references:
  - url: 'https://burger.d-zero.co.jp/blogs/archives/3'
    label: vultures@jpcert.or.jp
  - url: 'https://jvn.jp/en/jp/JVN21088484/'
    label: vultures@jpcert.or.jp
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T17:39:46.164484Z'
epss: 0.00435
epssPercentile: 0.37565
ingestedAt: '2026-09-11T14:42:19.866Z'
---

## Overview

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.