CVE-2026-91849 in WuzhiCMS
Summary
by MITRE • 09/15/2026
A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the component Avatar Upload. The manipulation of the argument File results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within WuzhiCMS versions up to 4.1.0 represents a critical security flaw located in the Avatar Upload component, specifically affecting the member::setAvatar function accessed via the endpoint /index.php?m=member&f=user&v=setAvatar. This issue is classified as an Unrestricted File Upload vulnerability, which falls under CWE-434 in the Common Weakness Enumeration standard. The core technical failure lies in the application's inability to properly validate or sanitize file inputs during the avatar upload process. Instead of enforcing strict constraints on file types, extensions, or content verification, the system accepts files from remote users without adequate inspection mechanisms. This lack of input validation allows an attacker to bypass intended security controls and inject malicious scripts into the web directory structure.
From a technical perspective, this flaw enables Remote Code Execution (RCE) when combined with server-side interpretation capabilities. By uploading a file containing executable code disguised as an image or other acceptable media type, an adversary can place a web shell on the target system. Once uploaded, if the web server is configured to execute scripts within the upload directory, the attacker gains the ability to run arbitrary commands with the privileges of the web service account. This scenario aligns closely with ATT&CK technique T1505.003, which involves Web Shell deployment as a method for maintaining persistent access and executing further malicious activities on compromised infrastructure. The availability of public exploits significantly lowers the barrier to entry for attackers, increasing the likelihood of automated scanning and exploitation attempts against unpatched instances.
The operational impact of this vulnerability is severe, potentially leading to complete compromise of the underlying server hosting WuzhiCMS. An attacker leveraging this flaw can exfiltrate sensitive data stored within the database or file system, modify website content for defacement purposes, or use the compromised host as a pivot point for lateral movement within an internal network. Given that the project maintainers have not yet responded to early reports of this issue, organizations running affected versions are exposed to prolonged risk without official patches available from the vendor side. This delay in remediation highlights the importance of proactive security monitoring and independent validation of third-party software components used in production environments.
Mitigation strategies for this vulnerability must prioritize immediate isolation or removal if possible due to the lack of an official patch. Administrators should restrict write permissions on upload directories to prevent new file creation unless absolutely necessary, although existing malicious files may already be present. Implementing a Web Application Firewall (WAF) with rules specifically targeting web shell patterns and unusual POST requests to avatar endpoints can provide temporary protection against exploitation attempts. Additionally, enforcing strict allow-lists for allowed file extensions at the application level or moving upload directories outside of the web root are effective architectural controls that prevent direct execution of uploaded files. Regular auditing of server logs for suspicious activity related to file uploads is also recommended to detect potential breaches early in the attack chain.