CVE-2026-14736 MEDIUM

CVE-2026-14736: Ruijie RG-UAC user_auth_commit.php unrestricted upload

Vendor Ruijie

Product RG-UAC

Weakness CWE-434 · Unrestricted file upload

Published July 5, 2026

Last update July 6, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file user_auth_commit.php. Performing a manipulation of the argument upload_image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

Key dates

02Disclosure timeline

July 5, 2026 CVE published

July 6, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-14736 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html AskarLabs — CWE-434 write-up Unrestricted Upload of File with Dangerous Type

Related vulnerabilities

04Related CVE

CVE-2026-39527 WordPress WpStream plugin < 4.11.2 - Arbitrary File Upload vulnerability CVE-2026-15158 Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter CVE-2026-57710 WordPress WoowBot Pro Max plugin <= 14.1.7 - Arbitrary File Upload vulnerability CVE-2026-14282 GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field CVE-2026-60032 Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0