Unrestricted file upload in jackq XCMS allows unauthenticated remote attackers to upload arbitrary files via the plupload example script, leading to arbitrary code execution. The vulnerability affects all rolling-release installations up to commit 3fab5342 and has published exploit code. No vendor patch is available, and the project has not responded to reports.
PHP
Authentication Bypass
File Upload
NVD
VulDB
CVSS 4.0
5.5
EPSS
0.1%