Windu CMS CVE-2026-57311

Q: What is the CVSS score of CVE-2026-57311?

CVE-2026-57311 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-45945 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-20 CERT-PL

GHSA-m87v-9vv3-8824

RCE File Upload Windu Cms Jcd

5.3

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Authenticated low-privilege upload of a PHP webshell enables full server-side RCE, warranting S:C and C:H/I:H/A:H over the understated official metrics.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 13:21 vuln.today

DescriptionCVE.org

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

AnalysisAI

Unrestricted file upload in Windu CMS version 4.1 enables authenticated low-privilege attackers to upload arbitrary PHP files and achieve remote code execution on the host server. The application performs no validation of uploaded file types, allowing a webshell to be placed and subsequently invoked via HTTP. No public exploit code has been identified at the time of analysis, and no KEV listing exists, but the attack path is trivial once credentials are obtained.

Technical ContextAI

Windu CMS (vendor: jcd, CPE cpe:2.3:a:jcd:windu_cms:*:*:*:*:*:*:*:*) fails to implement any server-side MIME type or file extension validation on its upload functionality, satisfying CWE-434 (Unrestricted Upload of File with Dangerous Type). When a PHP-capable web server hosts this CMS, uploaded .php files are interpreted and executed by the server-side runtime. The vulnerability is pure file-type blindness - no exploit sophistication is required beyond knowing how to submit a multipart upload request. The CVSS 4.0 vector (AV:N/AC:L/AT:N) confirms no network restriction or special attack requirement applies.

RemediationAI

No vendor-released patch has been identified at time of analysis; vendor contact attempts by CERT-PL were unsuccessful, leaving no confirmed fix version. Operators running Windu CMS 4.1 (or any version) should immediately restrict or disable the file upload functionality if it is not operationally required - doing so eliminates the attack surface entirely at the cost of any upload-dependent CMS features. If uploads must remain enabled, deploy server-side controls that deny execution of uploaded files: configure the web server (Apache/nginx) to serve the upload directory with PHP execution disabled (e.g., php_flag engine off in Apache's .htaccess or deny PHP execution via nginx location blocks for the upload path). Additionally, restrict upload access to only the minimum set of authenticated users who require it, enforce strong credential policies to reduce account compromise risk, and monitor upload directories for new .php files as a detection control. The CERT-PL disclosure is at https://cert.pl/posts/2026/07/CVE-2026-57309.