CVE-2026-105123
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path].
Risk Assessment
An authenticated editor can execute arbitrary code on the server, leading to full system compromise and arbitrary file deletion.
Recommendation
Update wcms to a version later than 3.18.0 that validates paths in the media API, and restrict editor permissions.
Other vulnerabilities in wcms
Original NVD description (English source)
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path].
Vulnerability data from NVD (NIST) · CISA KEV · EPSS