CVE-2026-15530 is an information disclosure vulnerability affecting WuzhiCMS up to version 4.1.0. The issue resides in the config/listimage function of the Attachment API endpoint (/index.php?m=attachment&f=index&v=upload). Remote attackers can exploit this flaw without authentication or user interaction to disclose sensitive information. The vulnerability has been publicly disclosed and exploit code is available. The vendor has not yet responded with a fix or mitigation guidance.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of information from the affected WuzhiCMS installations. This could potentially expose sensitive data managed by the CMS. There is no indication of privilege escalation, denial of service, or code execution associated with this vulnerability. No confirmed exploitation in the wild has been reported.

As of the current information, no official patch or remediation is available from the vendor. Users should monitor the vendor's communications for updates and consider implementing compensating controls such as restricting access to the affected endpoint or deploying web application firewalls to detect and block exploit attempts. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.