Is there a public PoC exploit available for CVE-2026-6561?

Yes, a public proof-of-concept exploit is available for CVE-2026-6561. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6561

Q: What is the CVSS score of CVE-2026-6561?

CVE-2026-6561 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23686 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-19 VulDB

PHP File Upload Eyoucms N A

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 19, 2026 - 08:22 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

Apr 19, 2026 - 07:32 vuln.today

EUVD ID Assigned

Apr 19, 2026 - 07:30 euvd

EUVD-2026-23686

Analysis Generated

Apr 19, 2026 - 07:30 vuln.today

CVE Published

Apr 19, 2026 - 07:15 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability was detected in EyouCMS up to 1.7.1. This issue affects the function edit_adminlogo of the file application/admin/controller/Index.php. Performing a manipulation of the argument filename results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

EyouCMS versions up to 1.7.1 allow high-privileged attackers to upload arbitrary files via manipulation of the filename parameter in the edit_adminlogo function, leading to information disclosure and potential code execution. The vulnerability requires authenticated admin access and is publicly exploitable with proof-of-concept code available on GitHub; the vendor has not responded to disclosure attempts.

Technical ContextAI

The vulnerability exists in the edit_adminlogo function within application/admin/controller/Index.php of EyouCMS, a PHP-based content management system. The issue is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), indicating insufficient validation of uploaded file names and types. The vulnerability allows attackers with high-level administrative privileges to manipulate the filename parameter to bypass upload restrictions, potentially enabling arbitrary file placement on the server. This is a file upload vulnerability in a PHP application where input sanitization is insufficient to prevent directory traversal or extension-based attacks.

RemediationAI

No patched version has been confirmed by the vendor at this time. Immediate mitigation steps include upgrading EyouCMS to any version after 1.7.1 if available, though vendor responsiveness is limited and update availability should be verified independently. In the interim, implement strict access controls to limit the edit_adminlogo function to absolutely necessary administrative users, disable admin accounts that are not actively used, and implement Web Application Firewall (WAF) rules to block requests containing suspicious filename parameters or path traversal sequences (../ or ..\) in the edit_adminlogo endpoint. Additionally, monitor the application/admin/controller/Index.php file for unauthorized file writes and implement file upload directory restrictions by configuring the web server to deny execution of scripts in upload directories via .htaccess or nginx configuration. If administrative functions cannot be restricted, consider network segmentation to limit admin panel access to trusted internal networks only.