CuteNews CVE-2026-36467

Requires an authenticated account with access to the CuteNews v2.1.2 Media Manager panel (an administrative/editor-tier privilege, matching CVSS PR:H) - this is the primary limiting factor and means the attacker must already be a trusted or compromised user, not an anonymous visitor. Given that access, exploitation is network-reachable with low complexity and no user interaction: the attacker uploads a dangerous-type file (PHP) that the media.php upload handler fails to restrict, then requests it to achieve code execution. There is no non-default configuration requirement beyond having the Media Manager feature enabled and reachable; the main defensive mitigations are restricting who holds Media Manager access, and upgrading past 2.1.2.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 High) describes a network-reachable, low-complexity flaw with total confidentiality/integrity/availability impact, but critically requires high privileges (PR:H) - an account with Media Manager panel access, which in CuteNews is an administrative/editor-tier role. This privilege gate is the single most important dampener on real-world risk. Corroborating signals point to LOW active-threat urgency: CISA SSVC scores Exploitation as 'none' and Automatable as 'no' (consistent with the need for authenticated, manual panel access), even though Technical Impact is 'total' (matching the C:H/I:H/A:H claim). No EPSS score, no CISA KEV listing, and no public POC are provided in the input. The signals are internally consistent rather than conflicting: high technical impact but a meaningful authentication precondition and no evidence of exploitation. This is a genuine RCE but not a mass-exploitation priority - treat as a patch-when-able hardening item for the small population running CuteNews, prioritized higher only where untrusted users hold Media Manager access. Note the CPE is a placeholder ('cpe:2.3:a:n/a:n/a') and EUVD affected versions read 'n/a n/a', so affected-version data is unreliable; the description explicitly names CuteNews v2.1.2.

An attacker who already holds (or has phished/compromised) an account with Media Manager access logs into the CuteNews 2.1.2 admin panel and uploads a malicious PHP file that bypasses the media type restrictions in core/modules/media.php. They then request the uploaded file's URL to execute it, spawning a reverse shell and gaining code execution in the web application's context. No public exploit code is identified in the provided data, though a third-party disclosure repository (UmbraDeorum/cutenews-2.0-CVEs-2026-Disclosure) is referenced.