Unauthenticated RCE patched in ThemisNETPanel
CERT Polska coordinated disclosure of CVE-2026-6847, an unauthenticated file-upload flaw in 4real ThemisNETPanel allowing arbitrary PHP code execution, patched in April 2026.
CERT Polska disclosed CVE-2026-6847, a remote code execution vulnerability in 4real ThemisNETPanel software stemming from a missing authentication check on a critical file upload endpoint. The flaw allows unauthenticated attackers to submit a base64-encoded payload containing an arbitrary PHP file, which is then written to the server and can be executed to gain full remote code execution on the underlying host.
The vulnerability was reported through CERT Polska's coordinated vulnerability disclosure (CVD) process, credited to researchers Kamil Szczurowski and Robert Kruczek. A vendor patch was released in April 2026, prior to this public advisory, reducing the window of exposure for organizations that have applied updates. No evidence of in-the-wild exploitation is mentioned in the report, and the disclosure appears to be a standard responsible-disclosure notice rather than an active attack campaign.
Mentioned in this report
Detection guidance
Web Server Process Spawning Command Shell (Possible Webshell Execution)
Detects a web server or PHP-FPM process spawning a system shell, consistent with post-upload execution of a malicious PHP file dropped via an unauthenticated file-upload RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Shell
description: Detects apache/nginx/php-fpm processes spawning shell interpreters, a
common post-exploitation behaviour after an unauthenticated file-upload RCE (e.g.
CVE-2026-6847) drops and executes a PHP webshell.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /php-fpm7
- /php-fpm8
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /perl
- /curl
- /wget
- /nc
filter_package_mgmt:
CommandLine|contains:
- apt-get
- dpkg
- yum
- systemctl
condition: selection and not filter_package_mgmt
falsepositives:
- Legitimate CGI scripts or admin panels that shell out to system utilities
- Server management scripts triggered through web hooks
level: high
id: 9d380a40-1115-5e43-aa52-a5995c27c5d4
status: experimental
author: Vorant
New PHP File Written by Web Server Process in Web Root
Detects a web server / PHP-FPM process account creating a new .php file inside typical webroot directories, consistent with an arbitrary file upload RCE writing an attacker-controlled PHP payload to disk. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: New PHP File Written by Web Server Process
description: Detects creation of new .php files by the web server or PHP-FPM process/user
in common webroot paths, which is the file-drop step of an unauthenticated file-upload
RCE like CVE-2026-6847.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|endswith: .php
TargetFilename|contains:
- /var/www/
- /htdocs/
- /public_html/
- /wp-content/uploads/
filter_deploy:
Image|endswith:
- /composer
- /git
- /rsync
- /scp
condition: selection and not filter_deploy
falsepositives:
- Legitimate deployment pipelines writing PHP application code to the webroot
- CMS plugin/theme installers that write PHP files at runtime
level: medium
id: d235f1a7-744e-5d07-bedd-9374f21b3d62
status: experimental
author: Vorant
Suspicious HTTP Upload Request Containing Base64-Encoded PHP Payload Marker
Detects HTTP POST requests whose body contains the base64 encoding of a PHP opening tag, indicating an attempt to upload an arbitrary base64-encoded PHP file via a vulnerable upload endpoint. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HTTP Request With Base64-Encoded PHP Tag Marker
description: Detects inbound HTTP POST requests carrying the base64 representation
of the PHP opening tag (<?php), a generic indicator of arbitrary file upload exploitation
such as CVE-2026-6847 where a base64-encoded PHP payload is submitted to an upload
endpoint.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
product: windows
detection:
selection:
cs-method: POST
cs-uri-query|contains:
- upload
- file
- import
payload_marker:
c-uri-query|contains:
- PD9waHA
- PD9QSFA
- PHA/cGhw
condition: selection and payload_marker
falsepositives:
- Legitimate applications that transmit base64-encoded PHP source as part of normal
update/backup workflows
- Security scanners testing upload endpoints with benign base64 payloads
level: medium
id: f4ca2f6a-524c-5df3-90bd-69bfbbce0818
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-6847
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free