CVE-2026-1152 is a medium-severity unrestricted file upload (CVSS 4.7) in technical-laohu mpay up to version 1.2.4. The codeimg argument of the QR code image handler can be abused remotely by an account with high privileges. The record lists no fixed version, so limit who can reach the admin area and check the project for a newer release.
What's affected
- Product: technical-laohu mpay, versions up to and including 1.2.4.
- Vulnerable component: the QR Code Image Handler, through the
codeimgargument. - Fixed version: none listed in the record. The record does not mention a vendor or project response.
- Weakness classes: CWE-434 (unrestricted upload of a dangerous file type) and CWE-284 (improper access control).
- Privileges: the CVSS vector requires high privileges (PR:H), which is why the score is 4.7 and not higher.
- Exploitation: the record says the exploit has been disclosed publicly. It is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
mpay is software you deploy yourself, so the check is a version and exposure review.
- Find where mpay runs and read the installed version from the project files or the admin page. Anything at 1.2.4 or below is in scope.
- List who holds admin or high-privilege accounts. The record rates this flaw as needing high privileges, so the number of such accounts is the size of the risk.
- Look at the folder that receives QR code images. Files that are not images, or files with script extensions, are a warning sign.
- Check whether the folder is served by the web server and whether the server will execute scripts from it.
What to do now
- Reduce the number of high-privilege accounts, enforce strong unique passwords and add multi-factor authentication where the product allows it.
- Configure the web server so the upload folder cannot execute scripts, and store uploads outside the web root where you can.
- Allow only the image types you expect, and check file content as well as the extension.
- Watch the project repository for a release later than 1.2.4 and read its notes before upgrading. The record does not confirm a fixed version.
Why it matters
Unrestricted upload means the application accepts a file without checking that it is the kind of file it expects. If the stored file can later be fetched and run by the server, an upload turns into code execution. The record does not say how far the impact goes for mpay, and the CVSS vector gives Low impact on each of confidentiality, integrity and availability.
The high-privilege requirement lowers the score, but it is not a comfort if admin credentials are shared, reused or weak. For any admin facing upload feature, protect the admin path and treat any unexpected file in the upload folder as an incident until you know otherwise.
Quick check
Why is the score only 4.7?
The vector requires high privileges (PR:H) and gives Low impact on confidentiality, integrity and availability. An attacker would need an admin level account first.
Is there a patched version of mpay?
The record does not list one. Check the project repository and its release notes.
Sources
- Gold entry and CVE record: CVE-2026-1152.
- References listed in the record, not retrievable for this review: researcher issue and the VulDB entry.
Last reviewed: 19 October 2026.
