CVE-2026-88419: n/a
An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file extension is taken verbatim from the client-supplied filename with no extension allowlist or content validation and the file is written to the web-accessible uploadfile/ directory, from which the web server executes PHP.
AI Analysis
Technical Summary
CVE-2026-88419 describes an unrestricted file upload vulnerability in WuzhiCMS version 5.0.0. The thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) accepts files without validating their extensions or content. An authenticated low-privileged member can upload a crafted .php file, which is saved verbatim in the web-accessible uploadfile/ directory. This allows remote code execution via the web server processing the uploaded PHP file.
Potential Impact
Successful exploitation allows an authenticated low-privileged user to execute arbitrary PHP code on the server, leading to full compromise of confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the thumbnail-upload endpoint to trusted users only and consider disabling it if possible. Monitor for suspicious uploads and remove any unauthorized PHP files from the uploadfile/ directory.
CVE-2026-88419: n/a
Description
An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file extension is taken verbatim from the client-supplied filename with no extension allowlist or content validation and the file is written to the web-accessible uploadfile/ directory, from which the web server executes PHP.
CVSS v3.1
Score 8.8high
Affected software
pkg:github/15536818056/WuzhiCMSRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-88419 describes an unrestricted file upload vulnerability in WuzhiCMS version 5.0.0. The thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) accepts files without validating their extensions or content. An authenticated low-privileged member can upload a crafted .php file, which is saved verbatim in the web-accessible uploadfile/ directory. This allows remote code execution via the web server processing the uploaded PHP file.
Potential Impact
Successful exploitation allows an authenticated low-privileged user to execute arbitrary PHP code on the server, leading to full compromise of confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the thumbnail-upload endpoint to trusted users only and consider disabling it if possible. Monitor for suspicious uploads and remove any unauthorized PHP files from the uploadfile/ directory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-09-10T00:00:00.000Z
- State
- PUBLISHED
Threat ID: 6ab2d808f7a7c54106a8a012
Added to database: 09/22/2026, 19:33:28 UTC
Last enriched: 09/22/2026, 19:49:13 UTC
Last updated: 09/23/2026, 01:58:06 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.