CVE-2026-116113

Name of the Vulnerable Software and Affected Versions GouGuOA versions prior to 6.1.3

Description A security flaw allows remote attackers to perform unrestricted file uploads. The issue exists within the chunkUpload() function located in the app/disk/controller/Api.php file, where improper handling of the file extension variable enables the upload of unauthorized files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the chunkUpload() function in the app/disk/controller/Api.php file to minimize the risk of exploitation.