CVE-2026-2113 is a high severity deserialization flaw (CVSS 7.3) in yuan1994 tpadmin up to version 1.3.12, in the WebUploader preview script. The record says the product is no longer supported by its maintainer and lists no fix, so remove the file or retire the install.
What's affected
The record names yuan1994 tpadmin up to and including 1.3.12, in the file public/static/admin/lib/webuploader/0.1.5/server/preview.php. The weaknesses are classed as CWE-502 (deserialization of untrusted data), CWE-434 (unrestricted upload) and CWE-20 (improper input validation). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
The record states that this only affects products no longer supported by the maintainer, so a vendor patch should not be expected. The record also says an exploit was disclosed publicly. It does not say the flaw is exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Look for the preview script in any tpadmin install and in any project that vendored the WebUploader library.
find /var/www -type f -path "*webuploader*" -name "preview.php" 2>/dev/null
If a copy exists, check whether it is reachable from the web by looking at your server configuration and logs for requests to that path. Also check your composer and project files for tpadmin.
grep -rIl "tpadmin" /var/www --include=composer.json 2>/dev/null
What to do now
- Delete the preview.php file from the WebUploader folder, or block the path at the web server. It is a demo helper, and production pages should not need it.
- Take the admin panel off the public internet or restrict it by network.
- Plan to move off tpadmin, because an unsupported admin template will not get fixes for the next issue either.
- Review recent file changes and web server logs for the path above, and rotate credentials if you see signs of misuse.
- Never pass user supplied data to PHP unserialize. Use a data format like JSON for anything that crosses a trust boundary.
Why it matters
Deserialization turns stored bytes back into live objects. When the bytes come from an attacker, the language runtime may build objects the developer never intended and run code in their methods. PHP is known for this class of bug, which is why guidance says to avoid unserialize on untrusted input.
Sample and demo scripts shipped inside front end libraries are a common source of these records. They get copied into projects along with the library and are never reviewed. An inventory of what you actually deploy, including bundled static folders, is the quickest way to find them.
Quick check
Why is no patch coming?
The record says the product is no longer supported by the maintainer. That means you should remove the vulnerable file or replace the product.
Sources
- Researcher write up on GitHub (linked from the record)
- NVD record for CVE-2026-2113
Last reviewed: 19 October 2026.
