CVE-2026-15530
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability has been found in WuzhiCMS up to version 4.1.0 in the Attachment API component. The config/listimage function in the file /index.php?m=attachment&f=index&v=upload allows manipulation leading to information disclosure. The attack can be performed remotely and an exploit has been published.
Risk Assessment
The risk involves remote information disclosure by an unauthenticated attacker, potentially leading to leakage of system or user data.
Recommendation
Immediately update WuzhiCMS to the latest available version beyond 4.1.0 or apply temporary mitigations such as blocking access to the vulnerable file. Monitor official vendor channels for a patch.
Other vulnerabilities in WuzhiCMS
See all- CVE-2026-91849Medium
A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the Avatar Upload component. The manipulation of the argument File results in unrestricted upload.
- CVE-2026-91848High
A vulnerability was identified in WuzhiCMS up to 4.1.0 in the article::getDataOfJson function of /index.php?m=content&f=article&v=getDataOfJson. Manipulation of the title/master_table arguments leads to SQL injection. The exploit is publicly available and can be used remotely.
- CVE-2024-32206Medium
In WUZHICMS v4.1.0, a stored XSS vulnerability exists in the /affiche/admin/index.php component. Attackers can inject arbitrary scripts or HTML via the $formdata parameter.
Original NVD description (English source)
A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=upload of the component Attachment API. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.