Wcms Issues 662

Back github.com

Wcms Issues 662

github.com • October 4, 2026

Share: View original

Unrestricted File Upload to RCE (CWE-434) Editor upload allows executable code into web-root with direct execution.

Path Traversal Arbitrary Write/Delete (CWE-22) .. in media path escapes media/ jail.

Stored/Reflected XSS (CWE-79) No HTML sanitization in render or templates.

Missing CSRF (CWE-352) No token in any controller/template.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-105123: Remote Code Execution in vincent-peugnet/wcms A remote code execution vulnerability, CVE-2026-105123, has been identified in vincent-peugnet/wcms versions up to 3.18.0. This flaw allows authenticated editors to upload arbitrary files, including .php files, by exploiting an unvalidated path in the upload API. Attackers can also use encoded ../ sequences to write outside the media directory and delete files via a specific DELETE request. The risk is particularly high for internet-facing CMS instances with editor accounts, especially those with multiple contributors. The exploitation status remains unconfirmed, and no proof-of-concept (PoC) or exploitation in the wild has been reported yet. Administrators are urged to review upload API logs and restrict access to trusted networks. The vendor has released a fix, and immediate application is recommended to mitigate risks. 2 sources 58

Extracted Entities

Attack Types (1)

Unrestricted File Upload

CWE Weaknesses (4)

CWE-22 - Path Traversal CWE-352 - Cross-Site Request Forgery (csrf)CWE-434 - Unrestricted Upload Of File With Dangerous Type CWE-79 - Cross-site Scripting (xss)

Vulnerabilities (4)

Missing CSRF Path Traversal Stored/Reflected XSS XSS