CVE-2026-10072 HIGH

CVE-2026-10072: Interinfo｜DreamMaker - Arbitrary File Upload

Vendor Interinfo

Product DreamMaker

Weakness CWE-434 · Unrestricted file upload

Published May 29, 2026

Last update May 29, 2026

View on NVD All CVEs

CVSS base score

8.6/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

DreamMaker developed by Interinfo has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Key dates

02Disclosure timeline

May 29, 2026 CVE published

May 29, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-10072 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2024-6115 itsourcecode Simple Online Hotel Reservation System add_room.php unrestricted upload CVE-2025-6327 WordPress King Addons for Elementor plugin <= 51.1.36 - Arbitrary File Upload vulnerability CVE-2023-1328 Guizhou 115cms index unrestricted upload CVE-2019-12803 Hunesion i-oneNet unrestricted file upload vulnerability CVE-2023-1713 Bitrix24 Remote Command Execution (RCE) via Insecure Temporary File Creation