Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-88419 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file extension is taken verbatim from the client-supplied filename with no extension allowlist or content validation and the file is written to the web-accessible uploadfile/ directory, from which the web server executes PHP.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: CISA-ADPCVSS-B:8.8 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/15536818056/CVE/issues/6	CISA-ADP	ExploitIssue TrackingTechnical Analysis
https://github.com/15536818056/CVE/issues/6	[email protected]	ExploitIssue TrackingTechnical Analysis

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-434	Unrestricted Upload of File with Dangerous Type	CISA-ADP

Affected Products

Product	Versions
WuzhiCMS	5.0.0 (semver)
CPE cpe:2.3:a:wuzhicms:wuzhicms:::::::: Remediation Workaround:low effort Restrict access to the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) and the avatar-upload endpoint (/index.php?m=member&f=user&v=setAvatar) to authenticated users or specific IP addresses. Mitigation:low effort Implement a web application firewall (WAF) rule to reject upload requests with a filename extension of a script type (e.g., .php, .phtml, .php3, .php4, .php5, .php7, .phar, .jsp, .asp, .aspx) for the affected endpoints. Mitigation:low effort Disable script execution in the upload storage directory (e.g., configure Nginx or Apache to deny PHP execution in the uploadfile/ directory).

Product

Versions

WuzhiCMS

5.0.0 (semver)

CPE

cpe:2.3:a:wuzhicms:wuzhicms:*:*:*:*:*:*:*:*

Remediation

Workaround:low effort
Restrict access to the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) and the avatar-upload endpoint (/index.php?m=member&f=user&v=setAvatar) to authenticated users or specific IP addresses.
Mitigation:low effort
Implement a web application firewall (WAF) rule to reject upload requests with a filename extension of a script type (e.g., .php, .phtml, .php3, .php4, .php5, .php7, .phar, .jsp, .asp, .aspx) for the affected endpoints.
Mitigation:low effort
Disable script execution in the upload storage directory (e.g., configure Nginx or Apache to deny PHP execution in the uploadfile/ directory).

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 22, 2026	New CVE Received	[email protected]
Sep 22, 2026	CVE Modified	CISA-ADP