Which versions of PHP are affected by EUVD-2026-14239?

Organizations using PbootCMS should be aware of moderate risk from CVE-2026-4509 rated CVSS 6.3. Exploitation could compromise the security of affected deployments.

Is there a public PoC exploit available for EUVD-2026-14239?

Yes, a public proof-of-concept exploit is available for EUVD-2026-14239. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-14239?

Within 30 days: Identify affected systems running PbootCMS and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP EUVD-2026-14239

Q: What is the CVSS score of EUVD-2026-14239?

EUVD-2026-14239 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4509 LOW

Incomplete List of Disallowed Inputs (CWE-184)

2026-03-21 VulDB

PHP File Upload

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 24, 2026 - 16:37 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 21, 2026 - 06:15 euvd

EUVD-2026-14239

Analysis Generated

Mar 21, 2026 - 06:15 vuln.today

CVE Published

Mar 21, 2026 - 06:02 nvd

MEDIUM 6.3

DescriptionCVE.org

A security flaw has been discovered in PbootCMS up to 3.2.12. This affects an unknown function of the file core/function/file.php of the component File Upload. The manipulation of the argument black results in incomplete blacklist. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

PbootCMS versions up to 3.2.12 contain an incomplete blacklist bypass vulnerability in the file upload functionality (core/function/file.php) that allows authenticated attackers to upload dangerous files by manipulating the blacklist parameter. An attacker with login credentials can bypass file type restrictions to upload arbitrary files, potentially achieving remote code execution or other malicious outcomes. A public proof-of-concept exploit is available on GitHub, increasing the practical risk of exploitation.

Technical ContextAI

The vulnerability exists in the PHP-based PbootCMS content management system's file upload handler. The affected component is located in core/function/file.php and implements a blacklist-based approach to restrict file uploads by file extension or type. The flaw is classified as CWE-184 (Incomplete List of Disallowed Inputs), a well-known weakness where blacklist validation fails to account for all dangerous file types or encoding bypass techniques. Rather than using a whitelist of permitted file types, the blacklist approach is inherently flawed as attackers can discover unlisted dangerous extensions (such as .phtml, .php3, .php4, .php5, .phar, etc.) or manipulate the 'black' parameter to disable restrictions entirely. This is compounded by PHP's flexible file handling capabilities, which can execute code from files with multiple extensions or non-standard PHP execution handlers configured on the web server.

RemediationAI

Immediately upgrade PbootCMS to a patched version newer than 3.2.12 if available from the vendor; if no patch exists, contact the PbootCMS development team to confirm a release timeline. As an interim mitigation, disable the file upload functionality entirely if not required for operations, or restrict file uploads to trusted administrators only by enforcing strict role-based access controls at the application level. Configure the web server (Apache/Nginx) to prevent PHP execution in user-writable directories by setting appropriate handler mappings and disabling script execution in upload folders via .htaccess (Apache) or location blocks (Nginx). Implement strict whitelist-based file type validation at the application level, accepting only specific safe extensions (e.g., .jpg, .png, .pdf) and validating file contents via magic byte inspection rather than relying solely on extensions. Monitor upload directories for suspicious files and enable detailed logging of all file upload attempts. References and additional guidance are available via VulDB at https://vuldb.com/?id.352075.