CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Arbitrary File Upload vulnerability exists in the REST API File Manager endpoint (POST /api/v1/files) of CubeCart. The endpoint allows any holder of an API key with files:rw permission to upload PHP source files into the web-accessible images/source/ directory, where they are executed by the web server. Combined with a path-traversal flaw in the same endpoint's filepath parameter, a single API request writes a webshell anywhere the webserver process can write — including the document root — yielding full Remote Code Execution. This vulnerability is fixed in 6.7.0.
Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.
Emlog versions prior to 2.6.11 contain a vulnerability in the plugin upload functionality that allows attackers to upload and execute arbitrary PHP code. This leads to complete server compromise and persistent backdoor installation. The issue is fixed in version 2.6.11.
Slider Revolution plugin for WordPress versions 7.0.0 through 7.0.10 contains a vulnerability allowing authenticated users with subscriber-level access or higher to upload arbitrary files due to insufficient file type validation. This can lead to remote code execution. The issue was partially fixed in version 7.0.10 and fully resolved in version 7.0.
CI4MS versions from 0.26.0.0 up to but not including 0.31.7.0 contain a vulnerability in the theme upload feature that allows authenticated backend users with theme-upload permission to upload crafted ZIP files containing PHP code. These PHP files are placed into a web-accessible directory without extension or content filtering, enabling remote code execution via HTTP requests. This vulnerability is identified as CWE-434 (Unrestricted Upload of File with Dangerous Type). A patch fixing this issue is available in version 0.
Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file to map .phtml extensions to the PHP handler. Attackers can upload a .phtml file containing arbitrary PHP code and execute the uploaded payload through a subsequent unauthenticated HTTP GET request to the uploaded file, resulting in remote code execution with web server privileges.
The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validating extracted file types. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files (including PHP) and achieve remote code execution via the Icons icon-pack upload flow.
CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::method_upload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a "Profile Picture" field is added to the form.
A vulnerability was found in GreenCMS up to 2.3. Affected is the function themeadd of the file /index.php?m=admin&c=custom&a=themeadd. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-7043 is a medium severity vulnerability in GreenCMS versions up to 2.3 that allows unrestricted file upload via the pluginAddLocal function in the /index.php? m=admin&c=custom&a=pluginadd endpoint. This vulnerability can be exploited remotely without user interaction and affects only unsupported versions of GreenCMS. No official patch or remediation is available from the maintainer. The vulnerability has been publicly disclosed, but there are no confirmed exploits in the wild at this time.
The Drag and Drop File Upload for Contact Form 7 WordPress plugin (versions up to 1.1.3) contains a vulnerability allowing unauthenticated attackers to upload arbitrary PHP files due to improper file extension handling. The plugin extracts the file extension before sanitization and allows attacker control over the file type parameter, leading to potential remote code execution. However, an . htaccess file and filename randomization reduce the likelihood of successful exploitation. No official patch or remediation guidance is currently confirmed.
FlowiseAI Flowise versions prior to 3.1.0 contain a vulnerability that allows unrestricted upload of JavaScript files by modifying the Chatflow configuration file upload settings. This enables attackers to upload malicious Node.js web shells to the server, potentially leading to remote code execution. The vulnerability is identified as CWE-434 and has a CVSS score of 7.1, indicating high severity. A fix for this issue is available in version 3.1.0.
Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
The Breeze Cache plugin for WordPress contains a critical vulnerability (CVE-2026-3844) that allows unauthenticated attackers to upload arbitrary files due to missing file type validation in the 'fetch_gravatar_from_remote' function. This issue affects all versions up to and including 2.4.4 and can lead to remote code execution if exploited. Exploitation requires the 'Host Files Locally - Gravatars' setting to be enabled, which is disabled by default. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
IBM Security Verify Directory (Container) versions 10.0.0 through 10.0.0.3 contain a vulnerability that allows privileged users to upload files without proper validation of file types. This unrestricted file upload could enable the placement of malicious files within the system, which might be used to conduct further attacks. The vulnerability is identified as CWE-434 and has a medium severity with a CVSS score of 5.5. No official patch or remediation guidance has been provided yet by IBM.
CVE-2026-6835 is an arbitrary file upload vulnerability in the a+HCM product developed by aEnrich. It allows unauthenticated remote attackers to upload files of any type, including HTML documents, to arbitrary paths. This behavior may lead to cross-site scripting (XSS)-like effects. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media upload handler that allows authenticated attackers to execute arbitrary operating system commands by uploading a PHP webshell with a .phtml extension. Attackers can bypass the extension deny-list and upload malicious files to the publicly accessible media directory, then request the file over HTTP to achieve full server compromise.
Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist (`forbidden_extensions = php,exe`) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alternative PHP-executable extensions such as `.phtml`, `.phar`, `.php3`, `.php4`, `.php5`, `.php7`, and `.pht`. Files are stored in the publicly accessible `media/custom_options/quote/` directory, which lacks server-side execution restrictions for some configurations, enabling Remote Code Execution if this directory is not explicitly denied script execution. Version 20.17.0 patches the issue.