CVE-2026-86308 Details
Description
A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Common/Conf/config.php of the component Debug Mode. The manipulation of the argument DB_DEBUG results in information disclosure. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability in Light0011 CMS has been identified, specifically in the commit c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. The issue arises from the application's debug mode, which is permanently enabled in the production entry point. This configuration allows for database debugging and causes triggered exceptions to leak sensitive information, such as framework paths, line numbers, version details, and call stacks, to remote users. The vulnerability is present in the file 'App/Common/Conf/config.php', where the 'DB_DEBUG' argument is manipulated, leading to unauthorized information disclosure. This issue can be exploited remotely, and the public availability of the exploit has been noted.
The application should be configured to disable 'APP_DEBUG' and 'DB_DEBUG' in production environments. Detailed exceptions should be logged server-side only, while generic error identifiers are returned to clients.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/light0011/cms/ | [email protected] | ProductSource CodeVendor |
| https://github.com/light0011/cms/issues/10 | [email protected] | ExploitIssue TrackingRemedyTechnical DescriptionVendor |
| https://github.com/light0011/cms/issues/17 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-86308 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/894870 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/399481 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/399481/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| light0011 cms | f72cf46f601efb2a0618c3814cc2f61380b38930 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | [email protected] |