Docat versions prior to 1.6.0 contain an arbitrary file upload vulnerability in the Upload API due to lack of validation on uploaded file paths and types. This flaw allows attackers to overwrite sensitive configuration files or upload malicious files to the web server. While version 1.6.0 fixes filename-based path traversal, unrestricted file type uploads and their potential malicious effects remain unmitigated. Exploitation could lead to remote code execution or cross-site scripting depending on deployment context.
CVE-2026-90866 is a critical path traversal vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. A delegated Host Administrator could exploit this flaw to access unauthorized file system locations, potentially leading to remote code execution.
CVE-2026-90864 is a critical path traversal vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. A delegated Host Administrator could exploit this flaw to access or modify files outside their authorized scope, potentially compromising confidentiality, integrity, and availability of the system.
The Chat AI with Dispatcher WordPress plugin versions prior to 2.4 improperly validate uploaded files, relying solely on a client-supplied content type that can be spoofed. This vulnerability allows unauthenticated attackers to upload arbitrary files, including executable PHP scripts, potentially leading to remote code execution on the affected server. The issue is fixed in version 2.4.
openEQUELLA before version 2026.1 contains a vulnerability in the pre-login notice image upload endpoint that allows users with EDIT_SYSTEM_SETTINGS permission to upload files without proper type validation. This can lead to stored cross-site scripting (XSS) by uploading HTML files served as text/html. Unauthenticated exploitation is possible if the guest user or everyone has been granted this permission.
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.
The Contact Manager plugin for WordPress up to version 9.1.2 contains an arbitrary file upload vulnerability due to an incomplete extension blacklist. This flaw allows unauthenticated attackers to upload potentially executable files by exploiting a trailing dot in filenames that bypasses extension checks. Successful exploitation requires the server to run Apache with libapache2-mod-php, enabling remote code execution within a brief window before the uploaded file is deleted.
The Innovative Form Builder – IvyForms WordPress plugin versions up to 1.5.1 contain an arbitrary file upload vulnerability. Authenticated users with custom-level access can configure a file upload field to allow dangerous file types such as PHP. This bypasses WordPress's native MIME and extension checks, enabling unauthenticated users to upload potentially executable files via a public REST API endpoint. This vulnerability can lead to remote code execution.
CVE-2026-103688 is a critical vulnerability in the Checkout Files Upload for WooCommerce WordPress plugin before version 2.4.0. The plugin does not validate uploaded file types when the accepted file types setting is empty, allowing unauthenticated users to upload arbitrary files, including PHP scripts. This can lead to remote code execution on servers that execute PHP files from the uploads directory. The issue is fixed in version 2.4.0.
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display WordPress plugin up to version 3.9.2 contains an arbitrary file upload vulnerability. This flaw arises from insufficient validation of file types in the upload_image function, allowing authenticated users with contributor-level access or higher to upload potentially executable files. Exploitation requires the plugin's "import product image" option to be enabled, which triggers the vulnerable image download process during product post saves. Successful exploitation could lead to remote code execution on the affected system.
Pie Register Premium WordPress plugin versions up to 3.8.4.0 suffer from an unrestricted file upload vulnerability due to improper validation and missing security checks in the AJAX handler. This allows unauthenticated attackers to upload and execute malicious files such as PHP scripts, potentially leading to remote code execution. The server response reveals the uploaded file's path, facilitating exploitation.
Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files.
CVE-2026-115188 is a critical unrestricted file upload vulnerability in Mautic core versions 7.0.0 up to but not including 7.2.2. It affects the campaign import feature, allowing an authenticated user with campaign import permissions to upload arbitrary files, including server-side scripts, to a publicly accessible media directory. This can lead to remote code execution with the privileges of the web server user, exposing sensitive configuration and contact data. The vulnerability does not require administrator privileges and is fixed in version 7.2.2.
baserCMS versions from 5.0.0-beta1 up to but excluding 5.3.2, and from 5.4.0 up to but excluding 5.4.2, contain a vulnerability in the PermissionGroupsService::build() method. When a plugin's config/permission.php file is missing, the system grants overly permissive access rules to non-admin groups. Specifically, the default operators group can upload and execute arbitrary PHP files under the document root after installing the BcCustomContent plugin, which lacks this config file. This allows unauthorized code execution. Versions 5.3.2 and 5.4.2 include patches that fix this issue.
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution.
CVE-2026-59188 is a cross-site scripting (XSS) vulnerability in Part-DB-server versions prior to 2.12.3. The server incorrectly sanitizes SVG files based on the file extension rather than the actual content type, allowing authenticated attackers to upload malicious SVG files disguised with non-SVG extensions. When users view these attachments inline, the embedded JavaScript executes in the context of the Part-DB origin. This vulnerability has been fixed in version 2.12.3.
CVE-2026-54630 is a critical vulnerability in Part-DB-server versions prior to 2.12.1. It allows authenticated users in the default users group to upload .phar files as attachments, which are stored in a web-accessible directory and executed as PHP due to the server's Apache configuration. This leads to arbitrary code execution as the web server user. The issue arises because the extension blocklist does not include .phar, and the upload handler does not properly restrict attachment types. The vulnerability has been patched in version 2.12.1.
A critical vulnerability (CVE-2026-102785) affects the YOOtheme Pro extension for Joomla versions 5.0.0 through 5.0.52. The flaw involves an unauthenticated remote code execution via an image transformation handler that improperly validates request signatures. Attackers can reuse legitimate signatures to inject additional image operations, traverse directories, and upload a malicious PNG/PHP polyglot file to a publicly accessible media directory.
IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type.
CVE-2026-107188 is a critical vulnerability in Eptura Archibus allowing unrestricted upload of files with dangerous types. Attackers can upload JSP or JSPX files as export reports, which can then be accessed to execute arbitrary commands on the server. This vulnerability can be combined with an authentication bypass to run code without authentication.