The application upload endpoints configure only a destination directory and retain ThinkPHP's permissive default file policy. The public upload action accepts arbitrary extensions, MIME types, and sizes.
Commit f72cf46f601efb2a0618c3814cc2f61380b38930 .
Root cause and location
App/ /Controller/UserController.class.php:60-74 , App/Admin/Controller/ChapterController.class.php:57-70 , and App/Admin/Controller/AdController.class.php:43-56 call Think\\Upload::upload() after setting only rootPath . ThinkPHP/Library/Think/Upload.class.php:17-31 defaults mimes=[] , exts=[] , and maxSize=0 ; checks at lines 285-305 and 342-360 allow all when these values are empty. The action has no authentication.
Use a harmless PHP marker in an isolated Local-driver deployment where ./image/ is web served:
The audited Local-driver test saved image/2026-07-17/6a59d21387bd0.php . Requesting that generated filename returned:
The filename is randomized. In the committed SAE configuration, the confirmed result is arbitrary object upload; do not claim PHP execution unless the deployment's storage URL is proven to execute PHP. Capture the upload request and generated-file response in a terminal screenshot.
Attackers can upload arbitrary objects. On conventional local PHP hosting with an executable upload directory, this becomes unauthenticated remote code execution. It can also support storage abuse and malicious-file hosting in object-storage deployments.
Require authentication and authorization, allowlist extensions and verified MIME/content types, impose a size limit, generate server-side names, and store files outside the executable web root. Configure the web server to never execute uploads.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
