CVE-2026-15965

Name of the Vulnerable Software and Affected Versions MaxUpload – Big File Uploads – Increase Maximum File Upload Size versions prior to 1.4.1

Description An arbitrary file upload issue exists in the handle upload() function. A filename-validation mismatch occurs because extension and MIME checks are applied to the uploaded chunk's filename but not to the final assembled filename derived from the resumableFilename parameter. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution.

Recommendations Update MaxUpload – Big File Uploads – Increase Maximum File Upload Size to a version newer than 1.4.0. As a temporary workaround, restrict access to the handle upload() function to minimize the risk of exploitation.