W (<= 3.18.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/w--3.18.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 04 Oct 2026 05:00:08 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Code Execution in W CMS via Path Traversalhttps://feed.craftedsignal.io/briefs/2026-10-wcms-rce/Sun, 04 Oct 2026 05:00:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wcms-rce/W CMS versions 3.18.0 and earlier are vulnerable to remote code execution and arbitrary file deletion due to insufficient path validation in the media management API.W CMS (vincent-peugnet/wcms) through version 3.18.0 contains a critical remote code execution vulnerability originating from improper input validation within the API endpoints responsible for media management. Authenticated editors can exploit the path handling logic in the /api/v0/media/upload/[:path] endpoint to perform path traversal. By utilizing encoded dot-dot-slash (../) sequences, an attacker can bypass directory restrictions to write files, including malicious .php scripts, outside the intended media storage directory. Once placed, these scripts can be executed by the web server. Additionally, the /api/v0/media/[:path] endpoint is vulnerable to arbitrary file deletion, allowing authenticated users to disrupt the application or remove security configuration files. This vulnerability represents a significant risk to the integrity and availability of the host server environment.

Attack Chain

  1. Attacker authenticates as an editor user within the target W CMS instance.
  2. Attacker crafts a malicious HTTP POST request to /api/v0/media/upload/[*:path].
  3. The request includes an encoded directory traversal sequence (e.g., %2e%2e%2f) within the path parameter.
  4. The application fails to sanitize the path, allowing the attacker to target sensitive web-accessible directories.
  5. The attacker uploads a web shell disguised as a .php file to an executable location.
  6. The attacker navigates to the location of the uploaded file via the browser to trigger code execution.
  7. Optional: The attacker uses the DELETE method on /api/v0/media/[*:path] to remove application logs or critical files for post-exploitation cleanup.

Impact

Successful exploitation grants an authenticated editor full remote code execution capabilities on the underlying host server. This allows for total system compromise, including the ability to exfiltrate data, modify web content, or pivot into the internal network. Attackers may also cause denial-of-service conditions by deleting arbitrary application files necessary for CMS functionality.

Recommendation

Prioritized, concrete actions for detection engineering teams:

  • Upgrade W CMS to a version beyond 3.18.0 immediately to remediate CVE-2026-105123.
  • Deploy the Sigma rules provided in this brief to detect anomalous API requests targeting the media management endpoints.
  • Implement access control reviews for accounts with "editor" permissions, as these are the primary vector for this vulnerability.
  • Monitor web server access logs for anomalous POST and DELETE requests to /api/v0/media/ paths containing path traversal characters like "../" or URL-encoded equivalents.
]]>highadvisoryweb-applicationrcevulnerabilitypath-traversal