Unrestricted File Upload Vulnerability in iWebShop

A high-severity unrestricted file upload vulnerability, identified as CVE-2026-86666, exists in iWebShop-5 versions up to 5.15. The vulnerability is located within the uploadFile function of the controllers/pic.php file. Remote attackers can leverage this flaw to upload malicious files, such as web shells, to the web server, potentially leading to remote code execution. Public exploit code for this vulnerability is currently available, and the vendor has not yet addressed the issue. Organizations using iWebShop-5 are at risk of compromise and should restrict access to the affected upload functionality until a security patch is provided.

Impact

The vulnerability allows for remote file upload, which is a precursor to full system compromise or web defacement. Because the exploit is publicly available, the risk of automated or targeted exploitation is elevated. Organizations hosting e-commerce platforms using the affected versions of iWebShop are highly susceptible to malicious file drops and subsequent code execution.

Recommendation

• Implement request filtering at the web application firewall (WAF) to inspect POST requests directed to /controllers/pic.php for suspicious file extensions or content types.
• Monitor web server access logs for anomalous requests to the uploadFile function.
• Disable the affected functionality or restrict access to the /controllers/pic.php endpoint to known administrative source IPs until a vendor patch is released.