Is there a public PoC exploit available for CVE-2026-7044?

Yes, a public proof-of-concept exploit is available for CVE-2026-7044. Prioritise patching immediately. EPSS: 0.0%.

GreenCMS CVE-2026-7044

Q: What is the CVSS score of CVE-2026-7044?

CVE-2026-7044 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25721 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-26 VulDB

PHP File Upload

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 26, 2026 - 22:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 26, 2026 - 14:15 vuln.today

EUVD ID Assigned

Apr 26, 2026 - 14:00 euvd

EUVD-2026-25721

Analysis Generated

Apr 26, 2026 - 14:00 vuln.today

CVE Published

Apr 26, 2026 - 13:30 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was found in GreenCMS up to 2.3. Affected is the function themeadd of the file /index.php?m=admin&c=custom&a=themeadd. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Unrestricted file upload in GreenCMS up to version 2.3 allows authenticated remote attackers to upload arbitrary files via the themeadd function in the custom admin module, potentially enabling remote code execution or content manipulation. Publicly available exploit code exists and the vulnerability affects only end-of-life versions of the product.

Technical ContextAI

GreenCMS is a PHP-based content management system. The vulnerability exists in the administrative file upload handler at /index.php?m=admin&c=custom&a=themeadd, which processes theme uploads without proper file type or content validation. This is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerability where an authenticated user can bypass file extension checks or MIME type validation to upload executable code (typically PHP webshells) disguised as theme files. The vulnerability affects the custom theme management functionality in the admin panel.

RemediationAI

The primary remediation is to discontinue use of GreenCMS 2.3 and earlier versions and migrate to a modern, actively maintained content management system such as WordPress, Drupal, or Joomla. For organizations unable to immediately migrate, implement compensating controls: (1) Restrict administrative access to known IP ranges using web server configuration (e.g., .htaccess for Apache or nginx access_log rules), (2) Disable the custom theme upload feature entirely by removing or commenting out the themeadd function in /index.php or by restricting access to the /index.php?m=admin&c=custom route at the web server level, (3) Implement file type whitelisting at the web server level to block execution of uploaded files (set Execute-off for the upload directory in .htaccess or use nginx location blocks to deny PHP execution in upload paths), and (4) Monitor the upload directory for suspicious files and implement intrusion detection rules for known exploit patterns. Note that these controls do not eliminate the vulnerability itself and should be considered temporary bridges during migration planning. No vendor patch is available due to EOL status.