CVE-2026-113382

MEDIUM 6.3

arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Installer. Such manipulation of the argument plugin_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.1 can resolve this issue. The name of the patch is 04573681420295f7b327c9da3b101aed2f3cf432. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CWE	CWE-434 CWE-284
Vendor	arizu-id
Product	fast-tunnel
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for arizu-id fast-tunnel

Be the first to know when new medium vulnerabilities affecting arizu-id fast-tunnel are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

arizu-id / fast-tunnel

1.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/422655 vuldb.com: https://vuldb.com/vuln/422655/cti vuldb.com: https://vuldb.com/cve/CVE-2026-113382 vuldb.com: https://vuldb.com/submit/990501 github.com: https://github.com/arizu-id/fast-tunnel/commit/04573681420295f7b327c9da3b101aed2f3cf432 github.com: https://github.com/arizu-id/fast-tunnel/releases/tag/1.0.1 github.com: https://github.com/arizu-id/fast-tunnel/

Credits

🔍 c0rrup1_1 (VulDB User) VulDB CNA Team