CVE-2026-110025 Details
Description
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.
A vulnerability allowing unrestricted file uploads has been identified in Slackero phpwcms versions prior to 1.9.50 and 1.12.3. The issue arises from the public Form content type 23, which accepted uploaded files without properly validating their extensions against a denylist that excluded executable types. As a result, files with dangerous extensions, such as .phtml, could be uploaded and executed as PHP code on the server. The vulnerability can be exploited remotely, without any authentication or special privileges.
Users can upgrade to phpwcms versions 1.9.50, 1.12.4, or the 2.0.0-dev branch to address this vulnerability. The latest release version is 1.12.4. After upgrading, it is recommended to remove or block access to the 'content/form/' directory to prevent exploitation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/slackero/phpwcms/ | [email protected] | Vendor |
| https://github.com/slackero/phpwcms/commit/f4c136b467565b2d16ebe2b8276b9a03547a9a69 | [email protected] | Source CodeVendor |
| https://github.com/slackero/phpwcms/releases/tag/v1.12.4 | [email protected] | Release NotesVendor |
| https://github.com/slackero/phpwcms/security/advisories/GHSA-2c7r-324f-fxm4 | [email protected] | AdvisoryRemedyVendor |
| https://vuldb.com/cve/CVE-2026-110025 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/992814 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/417752 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/417752/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| slackero phpwcms | >= 1.9.0, < 1.9.50 (semver) >= 1.10.0, <= 1.12.3 (semver) 2.0.0-dev (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |