Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.0
Unrestricted File Upload in mingSoft MCMS 6.1.1
CVE-2026-2666
GHSA-r9wp-qq53-qvjx
Summary
A security issue in mingSoft MCMS 6.1.1 allows attackers to upload files without restriction, potentially allowing them to inject malicious code. This could lead to unauthorized access to sensitive data. Update to the latest version of mingSoft MCMS to fix this vulnerability.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| mingsoft | net.mingsoft:ms-mcms | <= 6.1.1 | – |
| mingsoft | mcms | 6.1.1 | – |
Original title
mingSoft MCMS does not properly restrict file uploads
Original description
A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the component Template Archive Handler. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.
nvd CVSS2.0
5.8
nvd CVSS3.1
7.2
nvd CVSS4.0
5.1
Vulnerability type
CWE-284
Improper Access Control
CWE-434
Unrestricted File Upload
- https://github.com/chujianxin0101/vuln/issues/11 Exploit Issue Tracking
- https://github.com/chujianxin0101/vuln/issues/11#issue-3905144613 Exploit Issue Tracking
- https://vuldb.com/?ctiid.346463 Permissions Required VDB Entry
- https://vuldb.com/?id.346463 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.753243 Third Party Advisory VDB Entry
- https://nvd.nist.gov/vuln/detail/CVE-2026-2666
- https://github.com/advisories/GHSA-r9wp-qq53-qvjx
Published: 18 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026