CVE-2026-15530 is an information disclosure vulnerability affecting WuzhiCMS up to version 4.1.0. The issue exists in the Attachment API's config/listimage function accessible via /index.php with parameters m=attachment, f=index, and v=upload. Remote attackers can exploit this flaw without authentication to disclose information. The vulnerability was responsibly reported to the project, but no response or fix has been provided yet. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of information from the affected WuzhiCMS installation. The disclosed information could potentially aid further attacks or leak sensitive data. There is no indication of privilege escalation, integrity, or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider applying access controls or network restrictions to limit exposure of the vulnerable endpoint until an official patch is available.