CVE-2026-110025 in phpwcms
Summary
by MITRE • 10/13/2026
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in phpwcms versions up to 1.9.49 and 1.12.3 represents a critical security flaw within the Extension Check module, specifically located in the file include/inc_front/content/cnt23.article.inc.php. This component is responsible for handling content management operations, but it fails to adequately validate or sanitize input data received via HTTP POST requests. The core technical deficiency lies in how the system processes the name argument submitted by users during article creation or modification tasks. Instead of enforcing strict constraints on file names and types, the application allows attackers to manipulate this parameter to bypass existing upload restrictions. This lack of proper validation enables an attacker to execute what is classified as unrestricted file upload, a severe vulnerability that compromises the integrity of the web server hosting the content management system.
From a technical perspective, this flaw aligns with CWE-434, which describes the ability to upload arbitrary files without restriction. By exploiting the improper handling of the POST_name parameter, an attacker can trick the application into accepting and storing malicious scripts or executable payloads on the server's file system. Because phpwcms is typically deployed in environments where web accessibility is required for content publishing, this vulnerability provides a direct pathway for remote code execution if the uploaded files are subsequently accessed by the web server. The attack vector is classified as Remote (CVSS Vector: Network), meaning that no prior authentication or local access to the system is necessary to initiate the exploitation process. This significantly lowers the barrier for entry for threat actors, allowing them to compromise the underlying infrastructure from anywhere on the internet provided they can interact with the vulnerable endpoints.
The operational impact of this vulnerability extends beyond simple defacement or data leakage. Successful exploitation allows an attacker to gain a foothold within the server environment, potentially leading to full system compromise. Once malicious files are uploaded and executed, attackers can use these scripts as web shells to execute arbitrary commands, escalate privileges, pivot to other systems on the internal network, or exfiltrate sensitive data stored by the CMS. This scenario is consistent with ATT&CK technique T1505.003, which involves Server Software Component: Web Shell, and potentially leads to lateral movement within the organization's IT infrastructure. The persistence of these web shells allows attackers to maintain long-term access even if initial entry points are patched or discovered by administrators.
Mitigation strategies must prioritize immediate remediation through software updates. The vendor has addressed this issue in phpwcms versions 1.9.50 and 1.12.4, which include patches designed to enforce stricter input validation on the Extension Check component. Administrators should upgrade their installations to these patched versions as soon as possible to eliminate the vulnerability at its source. In addition to upgrading, organizations should implement defense-in-depth measures such as configuring web servers to prevent execution of uploaded files in directories designated for media storage. Implementing strict file type whitelisting and validating filenames against a secure pattern can further reduce risk if similar vulnerabilities exist elsewhere in the application stack. Regular security audits and monitoring for unusual file creation activities are also recommended to detect any potential exploitation attempts that may have occurred prior to patch deployment.