Description
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.
Published: 2026-10-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote File Upload
Action: Apply Patch
AI Analysis

Impact

The flaw in slackero's phpwcms Extension Check component permits an attacker to upload arbitrary files by manipulating the POST_name parameter. This vulnerability arises from improper access control (CWE‑284) and unchecked file type validation (CWE‑434). Because the upload is unrestricted, a malicious file could be stored on the web server and, if executable, may allow remote code execution or other compromise of confidentiality, integrity, and availability.

Affected Systems

The vulnerability affects slackero phpwcms versions up to 1.9.49 and 1.12.3.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not in the CISA KEV catalog. The attack can be initiated remotely by submitting a crafted POST_name value through the web interface. Once the upload succeeds, further exploitation depends on server configuration, but the lack of file type checks and missing access control make the initial step straightforward.

Generated by OpenCVE AI on October 13, 2026 at 19:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade phpwcms to version 1.9.50 or 1.12.4
  • Limit the types of files that may be uploaded by validating MIME type and file extension before saving
  • Configure the web server to block execution of files in the upload directory, for example using .htaccess directives or appropriate directory permissions

Generated by OpenCVE AI on October 13, 2026 at 19:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.
Title slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
First Time appeared Phpwcms
Phpwcms phpwcms
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:phpwcms:phpwcms:*:*:*:*:*:*:*:*
Vendors & Products Phpwcms
Phpwcms phpwcms
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Phpwcms Phpwcms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-15T15:11:53.863Z

Reserved: 2026-10-13T15:10:51.929Z

Link: CVE-2026-110025

cve-icon Vulnrichment

Updated: 2026-10-15T13:51:08.576Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T16:17:19.800

Modified: 2026-10-15T16:17:45.110

Link: CVE-2026-110025

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T12:30:08Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type