CVE-2026-94503

Summary

The PX-lab Zombify zombify application allows users to upload files without proper validation, enabling attackers to upload malicious web shells that can execute arbitrary code on the server. This creates a critical remote code execution vulnerability.

Exploitability

The vulnerability is highly exploitable with no prerequisites needed - any authenticated user can upload a web shell file and immediately execute code on the target server.

Blast radius

An attacker who successfully exploits this vulnerability could gain full control over the web server, potentially leading to data breaches, lateral movement, and complete system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.7.8 or later to remediate this unrestricted file upload vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.