CVE-2026-15518 is an unrestricted file upload vulnerability in AREA 17 Twill CMS affecting versions 3.0 to 3.6.0. The vulnerability exists in the FileLibraryController::storeFile function within src/Http/Controllers/Admin/FileLibraryController.php, specifically in the Media Library Insert Page component. Manipulation of the qqfilename argument enables attackers to upload arbitrary files remotely. The vulnerability has been publicly disclosed, but the vendor has not issued any response or patch. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required but high privileges needed, no user interaction, and low impact on confidentiality, integrity, and availability.

The vulnerability allows remote attackers with high privileges to upload files without restrictions, potentially leading to unauthorized file storage on the server. The impact on confidentiality, integrity, and availability is rated low, but the ability to upload arbitrary files could facilitate further attacks if exploited. No known exploits in the wild have been reported.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a fix is released, restrict access to the affected functionality to trusted users only and consider additional controls such as web application firewalls or manual review of uploaded files to mitigate risk.