CVE-2023-26775: Monitorr unrestricted file upload in upload.php enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw allows remote code execution via file upload and has a high EPSS score, but it is not in KEV and the record does not confirm a public exploit or a patched version.

What it is

Monitorr 1.7.6 exposes assets/php/upload.php without restricting uploaded file types, allowing a crafted file to be written to the server. Because the uploaded file can be executed, this leads to arbitrary code execution on the host. The flaw is a classic unrestricted file upload (CWE-434) in a monitoring web application.

Impact

An attacker who can reach the upload endpoint can place and execute arbitrary code, gaining code execution in the context of the web server. That typically means full control of the Monitorr instance and any data or credentials it can reach.

Attack surface

The vulnerable endpoint is assets/php/upload.php in the Monitorr web application, reachable over the network. The CVSS vector is AV:L/PR:N/UI:R, indicating the scored scenario requires local access and user interaction, though the description calls the attacker remote; the record does not reconcile this, so treat reachability as requiring access to the web interface and some user action.

Exploitation

No CISA KEV listing and no ransomware associations are recorded. EPSS is high (0.49367, 98.8th percentile), suggesting elevated likelihood of exploitation activity, but the references are product links and a Packet Storm XSS advisory, with no public exploit or PoC tagged.

What to do

• Upgrade Monitorr past 1.7.6 if a fixed release exists; the record does not name a patched version, so verify with the vendor.
• Restrict or disable the assets/php/upload.php endpoint and remove upload functionality that is not required.
• Enforce server-side allowlisting of file extensions and MIME types, and store uploads outside the web root with execute permissions removed.
• Require authentication and authorization for any upload endpoint and validate the uploader's role.
• If the product is unmaintained, isolate the Monitorr instance behind a reverse proxy or network ACL and monitor for upload abuse.

Detection

• Monitor web server and application logs for POST requests to assets/php/upload.php, especially with unusual file extensions or content types.
• Alert on new files written under the web root, particularly executable extensions such as .php, .phtml, .phar, or .jsp.
• Watch for child processes spawned by the web server user (for example PHP spawning shells or interpreters) as a sign of uploaded code execution.
• Baseline and hash files in the Monitorr assets directory to detect unauthorized additions or modifications.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.