slackero phpwcms up to 1.9.49/1.12.3 Extension Check cnt23.article.inc.php POST_name unrestricted upload

Summaryinfo

A vulnerability was found in slackero phpwcms up to 1.9.49/1.12.3. It has been declared as critical. Impacted is an unknown function of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. Such manipulation of the argument POST_name leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2026-110025. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in slackero phpwcms up to 1.9.49/1.12.3 (Content Management System). It has been rated as critical. Affected by this issue is some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. The manipulation of the argument POST_name with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability.

The weakness was disclosed 10/03/2026 as GHSA-2c7r-324f-fxm4. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-110025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1608.002.

By approaching the search of inurl:include/inc_front/content/cnt23.article.inc.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.9.50 or 1.12.4 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version. A possible mitigation has been published immediately after the disclosure of the vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Content Management System

Vendor

• slackero

Name

• phpwcms

Version

• 1.9.0
• 1.9.1
• 1.9.2
• 1.9.3
• 1.9.4
• 1.9.5
• 1.9.6
• 1.9.7
• 1.9.8
• 1.9.9
• 1.9.10
• 1.9.11
• 1.9.12
• 1.9.13
• 1.9.14
• 1.9.15
• 1.9.16
• 1.9.17
• 1.9.18
• 1.9.19
• 1.9.20
• 1.9.21
• 1.9.22
• 1.9.23
• 1.9.24
• 1.9.25
• 1.9.26
• 1.9.27
• 1.9.28
• 1.9.29
• 1.9.30
• 1.9.31
• 1.9.32
• 1.9.33
• 1.9.34
• 1.9.35
• 1.9.36
• 1.9.37
• 1.9.38
• 1.9.39
• 1.9.40
• 1.9.41
• 1.9.42
• 1.9.43
• 1.9.44
• 1.9.45
• 1.9.46
• 1.9.47
• 1.9.48
• 1.9.49
• 1.12.0
• 1.12.1
• 1.12.2
• 1.12.3

License

• open-source

Website

• Product: https://github.com/slackero/phpwcms/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #992814: slackero phpwcms <= 1.12.3 Unrestricted Upload / Remote Code Execution (CWE-434) (by fernando viana)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion