CVE-2026-74018

CriticalCVSS 9.9

Published: 20/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

Vulnerability allowing arbitrary file upload by users with Subscriber role in the Warehouse Cargo plugin. Affects versions up to 2.6.9.

An attacker with low privileges can upload malicious files to the server, potentially leading to remote code execution or site takeover.

Update the Warehouse Cargo plugin to a version that fixes this vulnerability and restrict user permissions.

Original NVD description (English source)

Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.