CVE-2026-86305: Unrestricted Upload in light0011 cms

The vulnerability CVE-2026-86305 affects the light0011 cms product due to an unrestricted upload flaw in the Upload::upload function of ThinkPHP/Library/Think/Upload.class.php. This flaw permits remote attackers to upload arbitrary files without restriction, potentially leading to further compromise. The product's rolling release strategy prevents precise version identification for affected or fixed releases. The vulnerability was responsibly disclosed but remains unaddressed by the vendor. Public exploit code has been released, indicating the potential for active exploitation.

Successful exploitation allows remote attackers to upload arbitrary files to the server, which can lead to unauthorized file execution, data compromise, or system takeover depending on the uploaded content and server configuration. The availability of public exploit code increases the likelihood of attacks. No specific details on post-exploitation impact are provided.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is released, restricting upload permissions, implementing strict file type validation, and applying other access controls may help mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.