wcms CVE-2026-105123

Requires an authenticated account with editor privileges (CVSS PR:L) on the wcms instance; exploitation specifically abuses the unvalidated [*:path] parameter of POST /api/v0/media/upload/ to upload executable .php files and uses encoded ../ traversal sequences to escape the intended media directory into a web-served location, with the corresponding DELETE /api/v0/media/[*:path] endpoint enabling arbitrary file deletion. The primary limiting factor is the need for valid editor authentication - anonymous/unauthenticated exploitation is not possible - and successful RCE further depends on the PHP files being written to a directory that the web server will execute; affected versions are wcms through 3.18.0.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects a network-reachable, low-complexity flaw requiring only low privileges (PR:L) - i.e. a valid editor account - and no user interaction, yielding full confidentiality, integrity, and availability impact on the vulnerable system via arbitrary PHP file write and execution. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The real-world risk is therefore moderated by two factors: exploitation is gated behind authenticated editor access (not anonymous), and the affected product (wcms, an independent flat-file CMS) has a very small deployment footprint. The technical impact is severe and the attack is straightforward once an editor account is obtained, but the combination of required authentication and niche product prevalence makes this a targeted/opportunistic concern rather than a mass-exploitation priority. Note: KEV, EPSS, and POC signals are all absent from the input, so exploitation-likelihood cannot be quantitatively confirmed and this assessment rests on the CVSS vector and VulnCheck advisory alone.

An attacker who holds or phishes a low-privileged editor account authenticates to the wcms instance and sends a POST to /api/v0/media/upload/ with a .php payload and encoded ../ sequences in the path, writing a web shell outside the media directory into a web-served location. The attacker then requests the uploaded .php file, causing the web server to execute it and granting remote code execution as the web server user. No public proof-of-concept is referenced in the provided data.