{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/phpwcms--1.9.49/1.12.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:slackero:phpwcms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-110025"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["phpwcms (\u003c= 1.9.49/1.12.3)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","remote-code-execution","file-upload"],"_cs_type":"threat","_cs_vendors":["slackero"],"content_html":"\u003cp\u003eThe slackero phpwcms content management system contains an unrestricted file upload vulnerability in the Extension Check component, identified as CVE-2026-110025. The flaw exists within the file 'include/inc_front/content/cnt23.article.inc.php'. A remote, unauthenticated attacker can exploit this by manipulating the 'POST_name' argument during a request to the affected script. Successful exploitation allows an attacker to upload arbitrary files to the server, which can subsequently be used to achieve remote code execution. This vulnerability affects all phpwcms versions up to and including 1.9.49 and 1.12.3. Users are advised to upgrade to version 1.9.50 or 1.12.4 to remediate this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-110025 results in a complete compromise of the web application. Attackers can upload web shells or other malicious scripts to the server filesystem, leading to unauthorized code execution, data exfiltration, and potential lateral movement within the network. This impacts the confidentiality, integrity, and availability of the affected host.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch phpwcms to version 1.9.50 or 1.12.4 immediately.\u003c/li\u003e\n\u003cli\u003eAudit the 'include/inc_front/content/' directory for any unauthorized or unknown file types or recent modifications.\u003c/li\u003e\n\u003cli\u003eImplement strict ingress filtering for the web server to block suspicious file extensions (e.g., .php, .phtml, .php5) uploaded to document root directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T16:36:35Z","date_published":"2026-10-13T16:36:35Z","id":"https://feed.craftedsignal.io/briefs/2026-10-phpwcms-unrestricted-upload/","summary":"An unrestricted file upload vulnerability in the Extension Check component of phpwcms allows remote unauthenticated attackers to upload arbitrary files via the POST_name parameter.","title":"Unrestricted File Upload in phpwcms Extension Check","url":"https://feed.craftedsignal.io/briefs/2026-10-phpwcms-unrestricted-upload/"}],"language":"en","title":"CraftedSignal Threat Feed - Phpwcms (\u003c= 1.9.49/1.12.3)","version":"https://jsonfeed.org/version/1.1"}