CVE-2026-30761: SourceBans Material Admin Arbitrary File Upload RCE Vulnerability

Technical summary

CVE-2026-30761 is an arbitrary file upload vulnerability (CWE-434) in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6. The vulnerability stems from insufficient validation of uploaded files, permitting attackers to bypass file type checks and upload executable code disguised as or alongside image data. The CVSS 3.1 score of 7.3 (HIGH) reflects network accessibility, low attack complexity, and lack of authentication requirements, combined with impact to confidentiality, integrity, and availability. The attack vector is entirely unauthenticated and requires no user interaction.

Business impact

Successful exploitation grants attackers unauthorized code execution capabilities on game server administration systems. For organizations using SourceBans Material Admin v1.1.6, compromise could result in unauthorized access to player databases, server configuration theft, service disruption, or use of compromised infrastructure for lateral movement into broader network environments. Game communities and hosting providers face reputational damage, data breach notifications, and potential regulatory exposure if player personal information is accessed.

Affected systems

SourceBans Material Admin version 1.1.6 is directly affected. Organizations running this version in production—particularly game hosting providers, esports platforms, and community-managed game servers—should treat this as an immediate inventory priority. Older and newer versions require verification against vendor advisories to confirm scope and applicability.

Exploitability

This vulnerability is highly exploitable. The lack of authentication requirements (PR:N) and low attack complexity (AC:L) mean any unauthenticated attacker on the network can attempt exploitation without special tools or extensive reconnaissance. File upload functionality is typically exposed in web interfaces, making discovery trivial. No user interaction or social engineering is required; exploitation is entirely automated. The accessibility and simplicity create immediate operational risk.

Remediation

Upgrade SourceBans Material Admin to a patched version released after the vulnerability disclosure. Verify the specific patched version number with the vendor's official advisory, as the ground-truth data does not specify a remediation version. If an immediate patch is unavailable, restrict network access to the admin upload component using firewall rules or IP whitelisting, disable the upload functionality if not actively required, and implement file type validation and code execution prevention at the application and system level.

Patch guidance

Contact the SourceBans project maintainers or check official project repositories for a security update addressing CWE-434 file upload validation. Apply the patch to all production and staging instances of Material Admin v1.1.6 without delay. Verify the patch by reviewing release notes confirming the fix scope, then conduct post-patch testing to ensure upload functionality works as intended and rejects malicious payloads.

Detection guidance

Monitor the pages/admin.uploadmapimg.php endpoint for unusual file upload activity, including file types that deviate from expected image formats (e.g., .php, .exe, .sh uploads). Log and alert on POST requests to the upload handler from unexpected IP addresses or with suspicious file extensions or MIME type mismatches. Review uploaded file storage directories for executables or script files. Correlate uploads with subsequent process execution or filesystem modifications on the server. Implement Web Application Firewall (WAF) rules to block executable file uploads and enforce strict Content-Type validation.

Why prioritize this

This vulnerability merits immediate prioritization due to its HIGH CVSS score (7.3), complete lack of authentication barriers, remote exploitability without user interaction, and direct path to arbitrary code execution. Organizations running v1.1.6 face immediate risk and should treat patching as a critical control. Even organizations on other versions should verify their specific version status promptly.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects: Network accessibility (AV:N) allowing remote exploitation; Low attack complexity (AC:L) requiring minimal attacker effort; No authentication prerequisite (PR:N); No user interaction needed (UI:N); and impact across confidentiality (C:L), integrity (I:L), and availability (A:L). While the impact ratings are moderate, the attack ease and lack of barriers drive the HIGH severity classification.

Frequently asked questions