CVE-2026-112027: File and Directory Information Exposure in light0011 cms

This vulnerability in light0011 cms arises from improper handling of the filename argument in the file_exists function of the Uploadify component's check-exists.php script. An attacker can remotely manipulate this argument to gain exposure to file and directory information on the server. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity impact. The project was notified early but has not issued any patch or mitigation. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation allows an unauthenticated remote attacker to obtain information about files and directories on the affected system. This information disclosure can aid further attacks or reconnaissance but does not directly lead to code execution or privilege escalation based on the available data.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's channels for updates. Until a patch is released, restricting access to the vulnerable script or implementing web application firewall rules to block malicious input targeting the filename parameter may reduce exposure.