light0011 CMS CVE-2026-112027

Requires that the Uploadify component's Public/Home/js/uploadify/check-exists.php script is deployed and network-reachable on the target light0011 CMS instance. When present, exploitation needs no authentication, no user interaction, and works against default configurations - the attacker simply controls the filename argument. The key LIMITING factor is impact scope, not accessibility: the flaw only discloses whether files/directories exist (metadata/reconnaissance), yielding no file contents, write access, or availability impact, so its practical value is limited to aiding other attacks.

This is a genuinely low-priority issue despite a moderate 6.9 CVSS 4.0 score. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a trivially reachable, unauthenticated, network-based flaw, but the impact metrics tell the real story: only VC:L (low confidentiality), with VI:N and VA:N - this is pure information disclosure (CWE-538, file/directory existence), not code execution or data compromise. The E:P flag and the 'Publicly available' POC signal confirm proof-of-concept exploit code exists, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The single intelligence source is VulDB, and the 'exploit' reference is simply a GitHub issue report (issue #15) against an obscure open-source project that has not responded. Net assessment: real but minor - a high-reachability, low-impact disclosure bug in a niche product. It should not be prioritized over flaws with integrity/availability impact or confirmed exploitation. Note the conflict between the attention-grabbing 'attack may be launched remotely' phrasing and the actually narrow impact (merely confirming file/directory existence).

A remote, unauthenticated attacker sends a crafted request to Public/Home/js/uploadify/check-exists.php, supplying a chosen value in the filename parameter. Because the script passes this directly to file_exists(), the differing responses let the attacker enumerate which files and directories exist on the server, aiding reconnaissance for further attacks. Proof-of-concept exploit details are publicly documented in the project's GitHub issue tracker.