Slackero - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/slackero/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 13 Oct 2026 16:36:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnrestricted File Upload in phpwcms Extension Checkhttps://feed.craftedsignal.io/briefs/2026-10-phpwcms-unrestricted-upload/Tue, 13 Oct 2026 16:36:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-phpwcms-unrestricted-upload/An unrestricted file upload vulnerability in the Extension Check component of phpwcms allows remote unauthenticated attackers to upload arbitrary files via the POST_name parameter.The slackero phpwcms content management system contains an unrestricted file upload vulnerability in the Extension Check component, identified as CVE-2026-110025. The flaw exists within the file 'include/inc_front/content/cnt23.article.inc.php'. A remote, unauthenticated attacker can exploit this by manipulating the 'POST_name' argument during a request to the affected script. Successful exploitation allows an attacker to upload arbitrary files to the server, which can subsequently be used to achieve remote code execution. This vulnerability affects all phpwcms versions up to and including 1.9.49 and 1.12.3. Users are advised to upgrade to version 1.9.50 or 1.12.4 to remediate this vulnerability.

Impact

Successful exploitation of CVE-2026-110025 results in a complete compromise of the web application. Attackers can upload web shells or other malicious scripts to the server filesystem, leading to unauthorized code execution, data exfiltration, and potential lateral movement within the network. This impacts the confidentiality, integrity, and availability of the affected host.

Recommendation

  • Patch phpwcms to version 1.9.50 or 1.12.4 immediately.
  • Audit the 'include/inc_front/content/' directory for any unauthorized or unknown file types or recent modifications.
  • Implement strict ingress filtering for the web server to block suspicious file extensions (e.g., .php, .phtml, .php5) uploaded to document root directories.
]]>highthreatweb-vulnerabilityremote-code-executionfile-upload