Published:2026/08/04 Last Updated:2026/08/04
JVN#52865575
freo2 vulnerable to unrestricted upload of file with dangerous type
Overview
freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability.
Products Affected
- freo2 versions prior to Ver 2.0.0-alpha-14
Description
freo2 provided by refirio is a content management system written in PHP. freo2 contains the following vulnerability.
- Unrestricted upload of file with dangerous type (CWE-434)
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.6
- CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2
- CVE-2026-67243
Impact
A user with the highest-level administrative privileges for the product may upload executable files and execute arbitrary OS commands.
Solution
Update the Software
Update the software to the latest version according to the information provided by the developer.
Vendor Status
| Vendor | Link |
| refirio | Commits · refirio/freo2 · GitHub (Text in Japanese) |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
Credit
Kazuki Ozawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2026-67243 |
| JVN iPedia |
JVNDB-2026-000107 |