Multiple CVEs Discovered in light0011 CMS Affecting Remote Authentication and File Upload

• •Three critical CVEs identified in light0011 CMS with public exploit code available.
• •CVE-2026-86305 allows unrestricted file uploads, while CVE-2026-86306 enables improper authentication.
• •Immediate remediation is necessary for internet-facing installations to prevent unauthorized access.

Three critical vulnerabilities have been identified in the light0011 CMS, specifically CVE-2026-86305, CVE-2026-86306, and CVE-2026-86303. These vulnerabilities allow unauthenticated remote attackers to exploit improper authentication and unrestricted file uploads. The affected components include the Cookie Helper and the Upload function within ThinkPHP. The vulnerabilities were disclosed on September 7, 2026, and have public exploit code available. Internet-facing installations, particularly those using default configurations and lacking web application firewalls, are most at risk. The vulnerabilities pose a high practical risk, with potential impacts including unauthorized access, data theft, and service disruption. The project maintainers have been notified but have not yet responded to the issues. Immediate action is recommended for affected users to mitigate risks.