Description
A vulnerability has been found in GreenCMS up to 2.3. This impacts the function pluginAddLocal of the file /index.php?m=admin&c=custom&a=pluginadd. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-04-26
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Unrestricted File Upload
Action: Patch Immediately
AI Analysis

Impact

A vulnerability has been identified in GreenCMS in the pluginAddLocal routine of the index.php module used for adding local plugins. The flaw allows an attacker to upload arbitrary files without any verification of file type or access control. This can enable the placement of malicious scripts or other executable content, potentially leading to remote code execution or modification of site content. The weakness is classified as CWE-284 and CWE-434.

Affected Systems

The vulnerability affects GreenCMS versions up to 2.3, which are no longer supported by the maintainer. These releases contain the flaw, but no further security updates are released. Any deployment of these legacy versions, especially those exposed to the Internet, is at risk.

Risk and Exploitability

The CVSS score of 5.3 reflects moderate severity, but the EPSS score is below 1 % and the flaw is not listed in the CISA KEV catalog, suggesting exploitation is unlikely in the near term. Nevertheless, the attack can be launched remotely via the public pluginAddLocal endpoint, and the lack of ongoing support for affected versions further raises the risk of unpatched or misconfigured deployments.

Generated by OpenCVE AI on April 28, 2026 at 05:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade GreenCMS to a supported release or remove the vulnerable pluginAddLocal functionality altogether.
  • If an upgrade is not feasible, disable the pluginAddLocal endpoint or restrict access to the module to trusted administrators only, and enforce strict file‑type validation.
  • Implement server‑side checks to allow only safe file extensions and impose a maximum upload size to mitigate accidental or malicious uploads.
  • Deploy a web application firewall or other security controls to detect and block abnormal upload attempts, and monitor access logs for evidence of exploitation.

Generated by OpenCVE AI on April 28, 2026 at 05:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 26 Apr 2026 13:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in GreenCMS up to 2.3. This impacts the function pluginAddLocal of the file /index.php?m=admin&c=custom&a=pluginadd. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Title GreenCMS index.php pluginAddLocal unrestricted upload
First Time appeared Greencms
Greencms greencms
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:greencms:greencms:*:*:*:*:*:*:*:*
Vendors & Products Greencms
Greencms greencms
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Greencms Greencms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-27T13:59:28.420Z

Reserved: 2026-04-25T16:01:38.501Z

Link: CVE-2026-7043

cve-icon Vulnrichment

Updated: 2026-04-27T13:59:21.129Z

cve-icon NVD

Status : Deferred

Published: 2026-04-26T22:17:31.863

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-7043

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T05:30:23Z

Weaknesses