EUVD-2026-84851
GHSA-r6cc-qh78-7796
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister/obtain low-priv member account
-
DeliveryLog in and reach thumbUpload endpoint
-
ExploitUpload crafted .php thumbnail file
-
ExecutionFile written to web-accessible uploadfile/
-
PersistRequest uploaded PHP path
-
ImpactExecute arbitrary code on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged member account (PR:L) able to reach the thumbnail-upload endpoint /index.php?m=member&f=article&v=thumbUpload in WuzhiCMS 5.0.0. No user interaction and no admin rights are needed; exploitation works against the default upload handler because the stored file extension is copied verbatim from the client filename with no extension allowlist and no content validation, and files are written to the web-accessible uploadfile/ directory from which the server executes PHP. The primary limiting factor is the member-account prerequisite - trivial where self-registration is open, a real barrier where account creation is restricted. Exploitation also assumes the web server is configured to execute PHP within uploadfile/ (typical default). |
| Impact | This is a genuinely high-priority flaw where the signals align consistently. The vendor CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) matches the description: a network-reachable endpoint, low attack complexity, and only a low-privileged member account required to achieve full compromise. SSVC reinforces this with Technical Impact: total (arbitrary PHP execution = full server takeover) but Automatable: no, reflecting that the attacker must first hold a valid member session, which resists mass, unauthenticated automated exploitation. Exploitation status is 'publicly available exploit code exists' - the sole reference is a GitHub CVE issue write-up and SSVC lists Exploitation: poc, so a working technique is documented, but there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of active in-the-wild exploitation and no independent probability estimate. The main gating factor is authentication: PR:L means an attacker needs at least a low-privileged member account, which on a CMS with open self-registration is a very low bar. Net: a real, actionable priority for anyone running WuzhiCMS 5.0.0, tempered only by the product's small footprint and the auth prerequisite. |
| Exploit ScenarioDerived | An attacker registers or obtains a low-privileged member account and sends a crafted request to /index.php?m=member&f=article&v=thumbUpload uploading a file named e.g. shell.php; because the extension is taken verbatim from the client filename with no allowlist or content check, the file lands in the web-accessible uploadfile/ directory. The attacker then browses to the uploaded path, and the web server executes the PHP, yielding arbitrary code execution. A proof-of-concept write-up is publicly available in the referenced GitHub CVE issue. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Authenticated low-privileged members of WuzhiCMS 5.0.0 can convert a routine thumbnail upload into full remote code execution, because the member article thumbnail handler at /index.php?m=member&f=article&v=thumbUpload saves the client-supplied file extension verbatim and writes the file into the web-accessible uploadfile/ directory, where a PHP-enabled web server executes it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) confirms the attacker needs only a valid low-privilege account and no user interaction, while SSVC rates technical impact as total; publicly available exploit code exists, so the only real barrier is obtaining a member login, which is trivial where self-registration is open and a meaningful obstacle where account creation is restricted. There is no CISA KEV entry indicating confirmed active exploitation, and the risk is best characterized as a consistently high-priority, easily automated-adjacent upload flaw rather than a confirmed active campaign.
RemediationAI
No vendor-released patch was identified in the available intelligence, so the primary action is to remove the attack surface rather than rely on an upgrade. Highest-value mitigation is to stop PHP execution inside the upload directory: for Apache, disable the PHP engine for that path in .htaccess or the vhost (php_admin_flag engine off, or a Require all denied / RemoveHandler directive for .php), and for nginx, add a location block such as 'location ^~ /uploadfile/ { location ~ \.php$ { deny all; } }' so uploaded scripts are served as inert files; the trade-off is that a misconfigured overlay can break legitimate image serving, so validate after applying. In parallel, restrict the thumbnail-upload endpoint to trusted roles or disable it for ordinary members until a fixed release ships, since the feature is only reachable by authenticated members and removing it eliminates exploitation entirely at the cost of member thumbnail functionality. Where the endpoint must remain available, add server-side extension allowlisting and real content validation (magic bytes plus image re-encoding) on upload, and turn off open member self-registration so the PR:L prerequisite cannot be satisfied by arbitrary internet users. Until a vendor fix exists, also consider WAF rules blocking multipart uploads containing .php/.phtml/.php5 filenames to the member article path, and monitor uploadfile/ for newly written PHP files as a detection control. Track the public issue https://github.com/15536818056/CVE/issues/6 and the ENISA EUVD entry EUVD-2026-84851 for vendor patch information, and confirm exact fixed versions from the vendor before upgrading.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-434, unrestricted upload of a file with a dangerous type, in a PHP application. WuzhiCMS 5.0.0's member article module exposes a thumbnail upload action (/index.php?m=member&f=article&v=thumbUpload) intended for image files, but the handler trusts the client-supplied filename for the stored extension and performs neither an extension allowlist check (jpg/jpeg/png/gif) nor content validation such as magic-byte or MIME inspection. An attacker therefore uploads a file named, for example, shell.php, and the application writes it under uploadfile/ - a path directly served by the web server. Because the server is configured to hand .php files to the PHP interpreter (the typical default for an Apache mod_php, PHP-FPM, or equivalent deployment), a direct HTTP request to the uploaded file executes attacker-controlled PHP in the web server's process context. The supplied CPE data is generic (cpe:2.3:a:n/a:n/a) and the EUVD affected-version record is likewise 'n/a', so product identification rests on the description and the public CVE issue reference rather than a normalized vendor CPE; the SSVC assessment (Exploitation: poc, Automatable: no, Technical Impact: total) is consistent with the assessed vector and confirms that a working proof-of-concept exists without indicating that the upload has been weaponized into a self-propagating exploit chain.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Remote endpoint (AV:N), no special conditions once logged in (AC:L), a member account is required (PR:L), no interaction (UI:N); arbitrary PHP execution yields full C/I/A compromise.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file extension is taken verbatim from the client-supplied filename with no extension allowlist or content validation and the file is written to the web-accessible uploadfile/ directory, from which the web server executes PHP.
Executive ViewAI
WuzhiCMS 5.0.0 contains a high-severity upload flaw that lets an authenticated low-privileged member turn a routine thumbnail upload into remote code execution on the web server. Publicly available exploit code exists, and no CISA KEV entry indicates confirmed active exploitation, but the barrier is only a valid member account-trivial where self-registration is open. Leadership should care because successful exploitation can lead to full server compromise, data theft, website defacement, or lateral movement, with no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or restricting member self-registration, blocking or restricting access to /index.php?m=member&f=article&v=thumbUpload, disabling PHP execution in the uploadfile/ directory, enforcing strict file extension and MIME allowlists, storing uploads outside the web root, deploying WAF rules to block executable uploads, and auditing for webshells and unauthorized accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB