CVE-2026-49849
⛔ criticalSummary
xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a full system compromise. Version 3.0.4 fixes the issue.
CVSS Score
9.1
Critical
EPSS Score
0.7
Exploit Probability
Published Date
2026-08-21
First Seen: 2026-08-22
📊 Relative Risk Intelligence
This CVE is High Risk - more severe than 87.6% of all 348,756 vulnerabilities in our database.
#43,380
Top 25% most severe
Severity Percentile
Last Modified
2026-08-21
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE IDs (Weakness Types)