Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2026-112027: light0011 CMS discloses file names via Uploadify
CVE-2026-112027 · published today
Summary
The Uploadify component in light0011 CMS reveals the existence of files and directories when a remote user supplies a filename to the check-exists.php script. This can give attackers information about the server’s file structure, which may help them plan further attacks. Apply the vendor's patch or disable the vulnerable script until it is fixed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| light0011 | cms | c774dce31c6df0055568a8d5c53d964d99be199d |
Original advisory text
light0011 cms Uploadify check-exists.php file_exists file information disclosure
A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file_exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the argument filename results in file and directory information exposure. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
5.5
Medium
Type
CWE-538Insertion of Sensitive Information into Externally-Accessible File or Directory
CWE-200Information Exposure
Timeline
Published18 Oct 2026
Updated18 Oct 2026
First seen18 Oct 2026
Track software like this
Free during beta