Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

W cms lets editors upload and execute malicious PHP files

CVE-2026-105123 · published 15 days ago
Summary

The W content management system up to version 3.18.0 allows users with editor rights to place files anywhere on the server by abusing the media upload function. By uploading a specially named PHP file, an attacker can run code on the web server or delete other files, potentially compromising the whole site. Limit editor access, apply strict file‑type checks, and update to a patched version as soon as possible.

Original advisory text
W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path].
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published4 Oct 2026
Updated15 Oct 2026
First seen4 Oct 2026
Sources
CVE-2026-105123 · NVD
CVE-2026-105123 · OSV
Track software like this
Free during beta