CVE-2026-91849
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the Avatar Upload component. The manipulation of the argument File results in unrestricted upload.
Risk Assessment
The attack can be executed remotely, and the exploit has been released to the public and may be used for attacks, posing a high risk to the organization.
Recommendation
Update WuzhiCMS to a version later than 4.1.0 or apply mitigations, as the project has not responded to the issue report.
Other vulnerabilities in WuzhiCMS
See all- CVE-2026-92380High
WuzhiCMS up to 4.1.0 has an SSRF vulnerability in the ckditor::saveRemote function in coreframe/app/attachment/index.php (Remote Image Fetch component). Manipulation of source[] parameter leads to server-side request forgery.
- CVE-2026-88419High
An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server.
- CVE-2026-94102Medium
A flaw was found in WuzhiCMS up to 4.1.0 in /index.php?m=member&v=Login (Login component). Manipulation of the forward argument causes open redirect. The attack can be initiated remotely and the exploit has been published.
- CVE-2026-91848High
A vulnerability was identified in WuzhiCMS up to 4.1.0 in the article::getDataOfJson function of /index.php?m=content&f=article&v=getDataOfJson. Manipulation of the title/master_table arguments leads to SQL injection. The exploit is publicly available and can be used remotely.
- CVE-2026-15530Medium
A vulnerability has been found in WuzhiCMS up to version 4.1.0 in the Attachment API component. The config/listimage function in the file /index.php?m=attachment&f=index&v=upload allows manipulation leading to information disclosure. The attack can be performed remotely and an exploit has been published.
- CVE-2024-32206Medium
In WUZHICMS v4.1.0, a stored XSS vulnerability exists in the /affiche/admin/index.php component. Attackers can inject arbitrary scripts or HTML via the $formdata parameter.
Original NVD description (English source)
A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the component Avatar Upload. The manipulation of the argument File results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS