CVE-2026-105123: Unrestricted Upload of File with Dangerous Type in vincent-peugnet wcms

The vulnerability in vincent-peugnet wcms (up to 3.18.0) allows authenticated users with editor privileges to upload files without proper validation of file types or paths. This enables attackers to upload malicious .php files that the web server can execute, perform directory traversal to write files outside the designated media directory, and delete arbitrary files via the DELETE API. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote code execution on the web server, potentially leading to full system compromise. Attackers can execute arbitrary PHP code, manipulate files outside the media directory, and delete files arbitrarily, severely impacting confidentiality, integrity, and availability of the affected system.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated editor privileges, monitor and control file upload functionality, and consider implementing web application firewall rules to detect and block malicious upload attempts.