CVE-2026-108688

Executive Summary

CVE-2026-108688 is a missing authorization vulnerability (CWE-862) in the Eladmin application through version 2.7, specifically in the LocalStorageController uploadPicture handler. The flaw allows any authenticated low-privileged user to bypass the storage:add permission check and write files into server local storage via POST requests to /api/localStorage/pictures, while also disclosing absolute server paths. Because exploitation requires only a valid low-privileged account and no user interaction, any internet-exposed Eladmin instance with an open registration path or compromised low-privilege credential is at risk of unauthorized file write and information disclosure.

Technical Analysis

Eladmin is an open-source Java (Spring Boot–based) administration/back-office platform. The vulnerability resides in the LocalStorageController class, whose uploadPicture handler is intended to be gated behind the storage:add permission. The NVD description states that this authorization check is missing, meaning the endpoint fails to enforce the required privilege before processing an upload request.

The authorization model in Eladmin is expected to restrict storage-write operations to users holding the storage:add authority. In this case, any authenticated principal — regardless of privilege level — can reach the upload code path. Because the flaw is classified as CWE-862 (Missing Authorization), the defect is not a logic error in credential verification but an absent (or non-effective) access-control gate on the handler.

The attack surface is the HTTP endpoint /api/localStorage/pictures, reachable over the network (AV:N). The handler accepts POST requests carrying files presented as images. Two distinct impacts are documented:

1. Unauthorized file write (integrity, I:L): Files supplied by the attacker are written into server local storage. The low CVSS integrity rating (I:L) reflects the constrained write scope — files land in the application's local storage area, not arbitrary filesystem locations, per the description.
2. Absolute path disclosure (information disclosure): The handler discloses absolute server paths, which leak filesystem layout information useful for follow-on attacks (e.g., path-dependent file operations, log poisoning, or chaining with LFI/RCE elsewhere).

No code-level specifics beyond the class name LocalStorageController, the handler name uploadPicture, the endpoint /api/localStorage/pictures, and the permission string storage:add are provided in the source data. Claims about file-extension validation, MultipartFile parameter names, or response body structure would be speculative and are therefore not asserted. The confirmed facts are limited to: the endpoint accepts image-named files, writes them to local storage, and returns/discloses absolute server paths.

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates network reachability, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact scored (though absolute path disclosure is noted qualitatively in the description), low integrity impact, and no availability impact.

Exploitation Scenarios

No public PoC/exploit code is available for this CVE (POC_STATUS: None). The following attack chain is inferred strictly from the vulnerability class (CWE-862) and the details provided in the NVD description.

1. Reconnaissance / target identification. An attacker identifies an internet-exposed Eladmin instance running version 2.7 or earlier. This can be accomplished via Shodan/censys queries such as http.html:"eladmin" or http.title:"EL-ADMIN", or by directly probing the /api/localStorage/pictures endpoint. The attacker confirms the application version banner or behavior corresponding to a version at or below 2.7.

2. Obtain low-privileged access. The flaw requires authentication (PR:L). The attacker acquires any valid low-privileged account — via self-registration if enabled, purchased/leaked credentials, or a separate weak-credential compromise. Critically, the account does not need the storage:add permission, because that check is missing.

3. Trigger the missing-authorization flaw. The attacker sends a POST request to /api/localStorage/pictures with a file that is named/presented as an image. Because the uploadPicture handler does not enforce storage:add, the request is processed despite the caller lacking the permission. The handler writes the supplied file into server local storage.

4. Leverage disclosed information. The response/behavior discloses absolute server paths. The attacker harvests these paths to map the filesystem layout, which can support subsequent exploitation (e.g., locating upload directories, chaining with path-dependent vulnerabilities, or crafting targeted payloads for other flaws).

5. Post-exploitation impact. The attacker achieves unauthorized file write into local storage and obtains absolute path disclosure. Depending on how uploaded content is served or processed downstream (not specified in the source data), this could be a stepping stone toward further compromise; however, no such downstream RCE chain is confirmed by the provided data and is not asserted here.

No exploit code, Nuclei template, or in-the-wild campaign is known for this CVE as of the source data. The attack chain above is a class-level reconstruction, not a validated exploit.

Impact Assessment

The vulnerability enables a low-privileged authenticated user to perform actions reserved for higher-privileged accounts (unauthorized file upload) and to learn internal filesystem structure via absolute path disclosure.

• Confidentiality (C:N): No direct confidentiality impact is scored, though absolute server path disclosure provides reconnaissance value.
• Integrity (I:L): Unauthorized file writes into server local storage represent a limited integrity impact — the scope is confined to the local storage area, hence the low rating.
• Availability (A:N): No availability impact is scored.
• Scope (S:U): The impact remains within the application's security authority.
• Blast radius: Any deployed Eladmin instance ≤ 2.7 that exposes the /api/localStorage/pictures endpoint and permits low-privileged authentication. Internet-facing instances are at elevated risk. Business impact centers on weakened access control guarantees, potential storage abuse/quota exhaustion, and paving the way for follow-on attacks using leaked absolute paths.

The overall base score of 4.3 (Medium) reflects that exploitation is network-reachable and low-complexity but requires a valid account and yields limited single-impact (integrity) consequences.

Detection Guidance

Sigma Rule

title: Eladmin LocalStorageController Unauthorized Picture Upload (CVE-2026-108688)
id: 3f9c1a72-6d2e-4b8e-9c1a-72eladmin1086
status: experimental
description: Detects POST requests to /api/localStorage/pictures that may indicate exploitation of missing authorization in Eladmin's uploadPicture handler.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108688
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains: '/api/localStorage/pictures'
  condition: selection_method and selection_uri
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate privileged users performing authorized picture uploads
level: medium
tags:
  - attack.t1190
  - cve.2026-108688
  - cwe.862

YARA Rule

rule CVE_2026_108688_Eladmin_LocalStorage_Upload
{
    meta:
        description = "Detects HTTP requests targeting Eladmin LocalStorageController uploadPicture endpoint (CVE-2026-108688)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108688"
        cve = "CVE-2026-108688"

    strings:
        $uri = "/api/localStorage/pictures" ascii nocase
        $method = "POST" ascii
        $perm  = "storage:add" ascii nocase

    condition:
        uint16(0) == 0x4854 and $uri and $method
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108688 Eladmin Unauthorized Picture Upload via LocalStorageController"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/localStorage/pictures"; nocase; classtype:attempted-user; reference:cve,2026-108688; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108688; metadata:affected_product Eladmin, attack_target Web_Server, deployment Perimeter, signature_severity Minor, created_at 2026_01_01; sid:2026108688; rev:1;)

Elastic Detection

sequence by process.entity_id
  [network where http.request.method == "POST" and url.path == "/api/localStorage/pictures"]
  [file where file.path : "*" and event.action == "creation"]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND like(uri_path, "/api/localStorage/pictures%")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,eladmin,cve-2026-108688,">
  <rule id="108688" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <match>POST /api/localStorage/pictures</match>
    <description>CVE-2026-108688: Possible Eladmin unauthorized picture upload via LocalStorageController (missing storage:add permission check).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_108688,access_control_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is available from the tracked sources at this time.

1) Immediate mitigations

• Restrict network access to /api/localStorage/pictures and the Eladmin management interface (API gateway, WAF, or reverse-proxy ACLs) so that only trusted administrative networks can reach storage-upload functionality.
• Add a WAF/gateway rule to block POST requests to /api/localStorage/pictures from low-privileged or unauthenticated sessions, and monitor for POSTs to that path.
• Disable open self-registration if present, and audit existing low-privileged accounts, to reduce the pool of PR:L footholds.
• Apply defense-in-depth validation in front of storage endpoints (file-type verification, size limits, content scanning) where a reverse proxy or middleware layer permits.

2) Patch / upgrade steps

• No patch is available from tracked sources (Patch Confidence 0/4). Monitor the Eladmin project's repository and release notes for a fixed version beyond 2.7, and the NVD entry (CVE-2026-108688) for a vendor advisory.
• Once a patched release is published, upgrade and verify that uploadPicture now enforces the storage:add authority. Until then, treat any preserved 2.7 instance as vulnerable.
• If maintaining a fork, add an explicit authorization check (storage:add) at the entry of the uploadPicture handler as a compensating control.

3) Long-term hardening

• Enforce server-side authorization at the controller/handler layer for every storage operation, not only at the UI/menu layer.
• Return opaque relative references rather than absolute server paths in API responses to eliminate filesystem-layout disclosure.
• Store uploaded files outside the application deployment tree and never serve them directly; validate content against an allowlist of image MIME types.
• Adopt centralized access-control review (least privilege) and continuous authorization testing for privileged endpoints.

References

• NVD — CVE-2026-108688: https://nvd.nist.gov/vuln/detail/CVE-2026-108688
• MITRE CWE-862 (Missing Authorization): https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Eladmin project repository (monitor for fixes beyond 2.7; no advisory available at time of writing)
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/

No threat actor campaign, public PoC, Nuclei template, or exploit-in-the-wild evidence is known for CVE-2026-108688 based on the provided data. CISA KEV status: NO.