CVE-2026-75339 affects cjbi admin3 v3.0.0, where the storage endpoint /storage/upload lacks proper permission checks. Any authenticated user can upload arbitrary files to the server, creating a significant risk of malicious file uploads. Additionally, any anonymous (unauthenticated) attacker can download files stored on the system, leading to potential data exposure. The vulnerability combines an improper authorization flaw with an unauthenticated file access issue. This could allow attackers to upload web shells, malware, or other malicious content. The combination of unrestricted upload and unauthenticated download makes this a high-severity issue. A proof-of-concept reference is available on GitHub documenting the vulnerability details.
