CVE-2026-36467
HighCVSS 7.2Summary
In CuteNews v.2.1.2, core/modules/media.php allows unrestricted upload of files with dangerous types. This allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell.
Risk Assessment
An authenticated user with Media Manager access can execute arbitrary code on the server, leading to full server compromise and remote access.
Recommendation
Update CuteNews to a version later than 2.1.2 if available. Until patched, restrict Media Manager access to trusted administrators only and validate uploaded files.
Other vulnerabilities in CuteNews
See all- CVE-2026-36472Medium
CuteNews v2.1.2 is vulnerable to XSS in the __referer value. An attacker can execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msg_info page.
- CVE-2026-36471Unknown
Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables (including __referer) via a crafted base64-encoded serialized PHP payload submitted as a POST parameter.
- CVE-2026-36470Unknown
CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php.
- CVE-2026-36469Unknown
CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).
- CVE-2026-36468Medium
CuteNews v2.1.2 has a stored XSS vulnerability in index.php, where an unauthenticated attacker can supply an arbitrarily named URL parameter key containing an URL-encoded XSS payload, leading to script execution in the victim's browser.
Original NVD description (English source)
Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell.