CVE-2026-94503

Executive Summary

CVE-2026-94503 is an unrestricted file upload vulnerability (CWE-434) in the PX-lab Zombify component, affecting all versions through 1.7.7. The flaw allows an unauthenticated remote attacker to upload a file of a dangerous type and deploy a web shell to the underlying web server. With a CVSS base score of 10.0 and no vendor patch or workaround available, any internet-exposed instance is at critical risk of full server compromise.

Technical Analysis

The vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. In this class of flaw, an application accepts a user-supplied file and fails to properly validate or restrict the file type before persisting it to a location that is served or interpreted by the web server. The NVD description explicitly states the outcome: the vulnerability "allows Upload a Web Shell to a Web Server," meaning the upload functionality does not adequately enforce an allowlist of safe extensions or content types, and the storage location is reachable by the web server for execution.

The attack surface is the file upload handling logic exposed by Zombify. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C, exploitation is network-reachable, requires no authentication, needs no user interaction, and has low attack complexity. The scope change (S:C) indicates that a compromise of the vulnerable component can affect resources beyond its original security authority — consistent with an uploaded script executing under the web server's identity and impacting the host operating system.

No specific function names, upload endpoints, parameter names, or file paths are provided in the NVD description or CNA title. The precise validation failure (extension blocklist bypass, missing MIME check, missing content inspection, or unsafe storage directory) cannot be confirmed from the available data and is therefore not asserted here. The exploitable behavior should be treated at the vulnerability-class level: the upload routine fails to prevent dangerous file types from being written to a web-accessible location.

The weakness exists in all versions of Zombify from the earliest release through version 1.7.7. No fixed version is identified, and patch confidence is 0/4 with no tracked patch evidence.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available. The following chain is inferred strictly from the vulnerability class (CWE-434) and the NVD description.

1. Reconnaissance / target identification. The attacker identifies an internet-facing server running the PX-lab Zombify component at version 1.7.7 or earlier. Fingerprinting may be performed via web content signatures associated with the product.

2. Triggering the flaw. The attacker locates the file upload functionality that Zombify exposes and submits a file of a dangerous type rather than an intended safe format. Because the vulnerability is pre-authentication (PR:N) and requires no user interaction (UI:N), no credentials or victim cooperation are needed. The upload is accepted because the component does not enforce proper file-type restrictions.

3. Payload / execution method. At the vulnerability-class level, the attacker uploads a web shell — a server-side script in a language the web server interprets (for example, a script with an executable extension). The file is written to a location the web server can serve and execute, and the attacker then requests it to trigger execution. Specific request paths, parameters, and file names are not derivable from the available data.

4. Post-exploitation impact. Successful execution yields code execution in the context of the web server process, giving the attacker interactive control, the ability to run system commands, move laterally or escalate privilege, and establish persistence. The scope change in the CVSS vector reflects that impact extends beyond the vulnerable component to the host.

Impact Assessment

The CVSS 3.1 base score is 10.0 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. All three impact metrics are High: confidentiality, integrity, and availability are each fully impacted. This is driven by remote, unauthenticated, low-complexity exploitation that results in attacker-controlled code execution on the host.

Business impact includes total loss of confidentiality of data processed or stored on the affected server, complete loss of integrity (attacker-controlled content and system state), and potential loss of availability through tampering or destructive actions. Because a web shell provides an interactive foothold, the blast radius is the web server host and any trust relationships, credentials, network paths, or backend systems reachable from it. Internet-exposed instances are the primary concern; internal instances remain at risk from any network-reachable attacker. The CISA KEV catalog does not list this CVE and no EPSS score has been published by FIRST.org as of this report.

Detection Guidance

Sigma Rule

title: Suspicious File Upload to Zombify Upload Endpoint
id: 7a1c9f45-3b6e-4d2a-9c8e-9450300001cve
status: experimental
description: Detects HTTP file upload activity against PX-lab Zombify consistent with CWE-434 web shell upload (CVE-2026-94503)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94503
author: valtersit.com
date: 2026/02/14
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - 'zombify'
  selection_ext:
    cs-uri-stem|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.jsp'
      - '.asp'
      - '.aspx'
  condition: selection_method and (selection_uri or selection_ext)
falsepositives:
  - Legitimate uploads of permitted media types
level: high

YARA Rule

rule CVE_2026_94503_Zombify_Webshell_Upload
{
    meta:
        description = "Detects common web shell markers indicative of CWE-434 upload exploitation (CVE-2026-94503)"
        author = "valtersit.com"
        date = "2026-02-14"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94503"
    strings:
        $php1 = "<?php" ascii
        $cmd1 = "system(" ascii
        $cmd2 = "shell_exec(" ascii
        $cmd3 = "passthru(" ascii
        $cmd4 = "eval(" ascii
        $susp1 = "base64_decode(" ascii
        $susp2 = "Move_uploaded_file" nocase ascii
        $marker = "zombify" nocase ascii
    condition:
        (uint16(0) == 0x3F3C or $marker) and
        $php1 and 2 of ($cmd*, $susp*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94503 PX-lab Zombify Unrestricted File Upload Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"zombify"; nocase; http.content_type; content:"multipart/form-data"; nocase; pcre:"/filename=[^\r\n]*\.(php|phtml|php5|jsp|asp|aspx)/i"; classtype:web-application-attack; reference:cve,2026-94503; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94503; sid:9004503; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST" and
      http.request.body.content : "*multipart/form-data*" and
      url.path : "*zombify*" ]
  [ file where file.path : ("*.php", "*.phtml", "*.php5", "*.jsp", "*.asp", "*.aspx") and
      event.action : ("creation", "modification") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval method=upper(cs_method)
| where method="POST" AND (uri_path="*zombify*" OR uri_path="*.php" OR uri_path="*.phtml" OR uri_path="*.jsp" OR uri_path="*.asp" OR uri_path="*.aspx")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by src_ip
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort -count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-94503,">
  <rule id="100903" level="12">
    <if_sid>31100</if_sid>
    <match>POST</match>
    <regex>zombify.*(\.php|\.phtml|\.php5|\.jsp|\.asp|\.aspx)</regex>
    <description>CVE-2026-94503: Possible unrestricted file upload / web shell upload to PX-lab Zombify</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,file_upload,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is available.

1. Immediate mitigations. Restrict or disable the Zombify upload functionality until a fixed release is available. Where exposure cannot be removed, place the component behind authentication and network access controls, and block external reachability. Enforce server-side validation to allow only an explicit allowlist of safe file extensions and content types, and store uploaded files in a directory that is not served or interpreted by the web server (disable script execution in upload directories). Harden the web server so uploaded file types cannot execute.

2. Patch/upgrade steps. Monitor the PX-lab Zombify project for a security release and upgrade as soon as a fixed version is published. Because patch confidence is 0/4, no target version can currently be named; validate any future release against the vendor's advisory before deployment.

3. Long-term hardening. Apply WAF rules that block dangerous file types on upload endpoints, centralize file-upload validation logic, run the web service with least privilege, segment hosts to limit lateral movement after a foothold, and continuously monitor web and file-integrity logs for anomalous upload activity.

References

• NVD — CVE-2026-94503: https://nvd.nist.gov/vuln/detail/CVE-2026-94503
• CWE-434: Unrestricted Upload of File with Dangerous Type: https://cwe.mitre.org/data/definitions/434.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-94503 not listed)
• FIRST EPSS: https://www.first.org/epss (CVE-2026-94503 not yet scored)

No public proof-of-concept, exploit code, Nuclei template, or in-the-wild exploitation evidence is currently available for CVE-2026-94503. No known threat actor campaign has been attributed.