Description
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path].
Published: 2026-10-03
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 03 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Description W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path].
Title W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API
First Time appeared Wcms
Wcms wcms
Weaknesses CWE-434
CPEs cpe:2.3:a:wcms:wcms:*:*:*:*:*:*:*:*
Vendors & Products Wcms
Wcms wcms
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Wcms Wcms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-03T22:30:12.394Z

Reserved: 2026-10-03T12:05:26.755Z

Link: CVE-2026-105123

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-04T00:16:35.703

Modified: 2026-10-04T00:16:35.703

Link: CVE-2026-105123

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-04T00:30:05Z

Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type