PHP EUVD-2026-18346

Q: What is the CVSS score of EUVD-2026-18346?

EUVD-2026-18346 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5344 LOW

Path Traversal (CWE-22)

2026-04-02 cna@vuldb.com

GHSA-hwj5-vvrp-w79h

PHP Path Traversal

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Apr 02, 2026 - 15:22 euvd

EUVD-2026-18346

Analysis Generated

Apr 02, 2026 - 15:22 vuln.today

CVE Published

Apr 02, 2026 - 15:16 nvd

MEDIUM 5.3

DescriptionCVE.org

A security vulnerability has been detected in Textpattern up to 4.9.1. Affected by this vulnerability is the function mt_uploadImage of the file rpc/TXP_RPCServer.php of the component XML-RPC Handler. The manipulation of the argument file.name leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor confirmed the issue and will provide a fix in the upcoming release.

AnalysisAI

Path traversal in Textpattern XML-RPC handler allows authenticated remote attackers to write arbitrary files via the file.name parameter in mt_uploadImage function, enabling potential code execution or sensitive file overwrite. Affects Textpattern up to version 4.9.1, with publicly available exploit code and vendor confirmation of the issue pending fix in an upcoming release.

Technical ContextAI

The vulnerability exists in the XML-RPC Handler component (rpc/TXP_RPCServer.php) within Textpattern's mt_uploadImage function. The root cause is improper validation of the file.name argument, allowing directory traversal sequences (CWE-22) to be injected into file paths. When an authenticated user uploads an image via XML-RPC with a crafted filename containing path traversal characters (e.g., '../../../'), the application fails to neutralize these sequences before writing the file to disk. This is a PHP-based CMS vulnerability that exploits insufficient input sanitization in the XML-RPC interface, a widely-used protocol for remote procedure calls in web applications.

RemediationAI

Upgrade Textpattern to a patched version released after the vendor confirmation; the vendor has indicated a fix will be provided in an upcoming release, though the specific patched version number is not yet publicly identified in available data. As an interim mitigation, disable or restrict access to the XML-RPC Handler interface (rpc/TXP_RPCServer.php) if not in active use, implement strict input validation and sanitization on the file.name parameter to reject or strip path traversal sequences (e.g., '../', '..\'), and enforce file upload whitelisting by extension and destination directory. Additionally, limit XML-RPC access to trusted internal networks or require additional authentication factors. Monitor the Textpattern official release notes and security advisories for the specific patched version number and apply it immediately upon availability.