Is there a public PoC exploit available for EUVD-2026-43260?

Yes, a public proof-of-concept exploit is available for EUVD-2026-43260. Prioritise patching immediately. EPSS: 0.2%.

Twill CMS EUVD-2026-43260

Q: What is the CVSS score of EUVD-2026-43260?

EUVD-2026-43260 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-15518 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-13 VulDB

GHSA-q9gx-wp22-jh5r

PHP File Upload Twill Cms

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Admin authentication required (PR:H) but RCE via PHP webshell execution causes full scope change with high C/I/A impact on the underlying server.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 13, 2026 - 01:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 01:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

Analysis Generated

Jul 13, 2026 - 01:14 vuln.today

DescriptionCVE.org

A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Admin/FileLibraryController.php of the component Media Library Insert Page. Such manipulation of the argument qqfilename leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Unrestricted file upload in AREA 17 Twill CMS (versions up to 3.6.0) allows authenticated admin users to upload arbitrary file types via the qqfilename parameter in the Media Library Insert Page, creating a direct path to remote code execution on the underlying server. A public proof-of-concept documenting the full exploitation chain from file upload to RCE has been published by Bytium. No vendor patch exists - the vendor was contacted during responsible disclosure and did not respond, leaving all installations on affected versions without an official remediation path.

Technical ContextAI

Twill CMS is a Laravel/PHP-based content management system developed by AREA 17. The vulnerability resides in the storeFile method of FileLibraryController located at src/Http/Controllers/Admin/FileLibraryController.php, which handles file uploads through the admin Media Library component. The qqfilename HTTP parameter - used to specify the name of uploaded files - is not validated against an extension allowlist or denylist, satisfying CWE-434 (Unrestricted Upload of File with Dangerous Type). This permits an attacker to assign a .php extension (or other executable type) to a server-side file. If the upload directory is web-accessible and the server is configured to execute PHP (common in default Laravel/shared-hosting deployments), the uploaded file becomes a remote shell. Affected CPE: cpe:2.3:a:area_17:twill_cms:*:*:*:*:*:*:*:*, covering all versions through 3.6.0.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, and no fix version can be cited. As the primary compensating control, configure the web server to deny PHP execution within all CMS upload directories: in Apache, add php_flag engine off to a .htaccess file in the uploads path or use a <Directory> block; in nginx, add a location block denying PHP pass-through to php-fpm for the uploads path. Note this control eliminates the RCE step but does not prevent arbitrary file upload itself, and may require testing to confirm no legitimate application functionality depends on PHP execution in those directories. As a secondary control, restrict access to the Twill CMS admin panel to trusted IP ranges via firewall ACL or web server allow-list, eliminating remote exploitation by eliminating unauthenticated network reach to the vulnerable endpoint. Enforce multi-factor authentication on all admin accounts to raise the cost of credential compromise, which is the required prerequisite. Monitor https://vuldb.com/vuln/377847 for patch availability updates.