Unrestricted File Upload in phpwcms Extension Check

The slackero phpwcms content management system contains an unrestricted file upload vulnerability in the Extension Check component, identified as CVE-2026-110025. The flaw exists within the file 'include/inc_front/content/cnt23.article.inc.php'. A remote, unauthenticated attacker can exploit this by manipulating the 'POST_name' argument during a request to the affected script. Successful exploitation allows an attacker to upload arbitrary files to the server, which can subsequently be used to achieve remote code execution. This vulnerability affects all phpwcms versions up to and including 1.9.49 and 1.12.3. Users are advised to upgrade to version 1.9.50 or 1.12.4 to remediate this vulnerability.

Impact

Successful exploitation of CVE-2026-110025 results in a complete compromise of the web application. Attackers can upload web shells or other malicious scripts to the server filesystem, leading to unauthorized code execution, data exfiltration, and potential lateral movement within the network. This impacts the confidentiality, integrity, and availability of the affected host.

Recommendation

• Patch phpwcms to version 1.9.50 or 1.12.4 immediately.
• Audit the 'include/inc_front/content/' directory for any unauthorized or unknown file types or recent modifications.
• Implement strict ingress filtering for the web server to block suspicious file extensions (e.g., .php, .phtml, .php5) uploaded to document root directories.