CVE-2026-61524 in WebsiteBaker
Summary
by MITRE • 08/03/2026
WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file. Attackers can place the malicious archive through the module installation interface, causing the application to extract the webshell into a web-accessible modules/ subdirectory where it becomes immediately executable by any unauthenticated user via direct HTTP request.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability represents a critical security flaw in WebsiteBaker CMS versions prior to 2.13.10 that stems from inadequate input validation during module installation processes. The issue manifests as an unrestricted file upload vulnerability within the module installation feature, which allows authenticated administrators with sufficient privileges to bypass normal file type restrictions and upload malicious files alongside legitimate module metadata. The technical implementation flaw occurs when the application processes ZIP archives containing both a PHP webshell and a valid info.php metadata file, creating a scenario where the system extracts the malicious code without proper sanitization or validation of file contents.
The operational impact of this vulnerability is severe and directly enables remote code execution capabilities for attackers who can gain administrative access to the CMS. When an attacker uploads a crafted ZIP archive through the module installation interface, the application's extraction process places the PHP webshell into the web-accessible modules/ subdirectory, making it immediately executable by any unauthenticated user through direct HTTP requests. This creates a persistent backdoor that allows attackers to execute arbitrary commands on the server, potentially leading to full system compromise, data exfiltration, and further lateral movement within network environments.
The vulnerability aligns with CWE-434 Unrestricted Upload of File with Dangerous Type, which specifically addresses the dangers of allowing file uploads without proper validation of file types, content, or execution permissions. From an attack perspective, this flaw maps to multiple ATT&CK techniques including T1190 Exploit Public-Facing Application and T1059 Command and Scripting Interpreter, as it enables attackers to establish persistent access through web shells and execute commands remotely. The authentication requirement for exploitation limits the vector but does not eliminate the risk since administrative credentials are often obtained through other attack vectors such as credential stuffing, phishing, or exploiting additional vulnerabilities in the application stack.
Mitigation strategies should focus on implementing strict file validation mechanisms during upload processes, including content type checking, file extension filtering, and execution permission restrictions on uploaded files. Organizations should immediately upgrade to WebsiteBaker CMS version 2.13.10 or later, which includes patches addressing this vulnerability through enhanced input validation and proper sanitization of uploaded module archives. Additional defensive measures include implementing web application firewalls with rules to detect suspicious file upload patterns, restricting administrative privileges to only necessary users, and monitoring for unusual file creation activities in web-accessible directories. Regular security audits should verify that no malicious files exist in the modules/ directory and that proper access controls are enforced on all uploaded content.