CVE-2026-112027 in cms
Summary
by MITRE • 10/19/2026
A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file_exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the argument filename results in file and directory information exposure. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The identified vulnerability resides within the Light0011 content management system, specifically affecting the Uploadify component located at Public/Home/js/uploadify/check-exists.php. This flaw is centered on the file_exists function, which handles user-supplied input via the filename argument without adequate sanitization or validation. The core technical issue stems from an improper handling of this parameter, allowing attackers to manipulate the path traversal logic inherent in how the system checks for file existence. By crafting specific requests that exploit weaknesses in directory resolution, an attacker can bypass intended access controls and trigger the function to reveal sensitive information about the underlying server's file structure.
This vulnerability is classified as a Path Traversal or Directory Traversal issue, which aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The operational impact involves unauthorized disclosure of internal system architecture details. When exploited successfully, it allows remote attackers to enumerate files and directories on the target server. This information exposure is particularly dangerous as it serves as reconnaissance data for subsequent attacks. Attackers can use this knowledge to identify configuration files, backup archives, or other sensitive resources that may contain credentials or further exploitable code paths. The ability to launch such an attack remotely means no prior authentication is required, significantly lowering the barrier to entry for malicious actors.
The presence of a public exploit indicates that the risk level is critically high and immediate action is necessary. Since the project maintainers have not yet responded to early reports, users must rely on independent mitigation strategies rather than waiting for an official patch. The lack of vendor response underscores the importance of proactive security measures in environments running this specific version of Light0011 or any system utilizing a similar implementation of the Uploadify component with vulnerable check-exists.php logic.
To mitigate this vulnerability, administrators should immediately restrict access to the Public/Home/js/uploadify/check-exists.php file if it is not strictly required for public-facing operations. Implementing web application firewall rules that detect and block path traversal sequences such as ../ or encoded variants can provide a layer of defense against exploitation attempts. Additionally, ensuring that PHP configurations disable directory listing and limit error reporting to prevent detailed stack traces from being returned in HTTP responses will reduce the effectiveness of this information disclosure vector. Upgrading to a patched version of the CMS once available is essential for long-term security posture improvement.
From an offensive security perspective, this vulnerability maps directly to MITRE ATT&CK technique T1083: File and Directory Discovery. Adversaries leverage such flaws during the early stages of intrusion campaigns to map out target environments before deploying more destructive payloads like ransomware or data exfiltration tools. Understanding this context highlights why even seemingly minor information leaks are critical security events that require immediate remediation to prevent escalation into full system compromise.