CVE-2026-17399 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves insufficient validation of uploaded file content, allowing a remote authenticated attacker to execute arbitrary code on the server. The flaw arises from unrestricted upload of files with dangerous types that are not properly checked before processing.
The Interactive Real Estate – Floor Plan & Building Visualizer WordPress plugin up to version 2.6.0 contains an arbitrary file upload vulnerability via the extract_zip_data function. Authenticated users with subscriber-level access or higher can upload malicious files due to missing capability checks, nonce verification, and file type validation. Exploitation requires the plugin's Freemius Premium license or trial to be active, enabling remote code execution.
The payever WooCommerce Gateway plugin for WordPress up to version 4.8.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload executable PHP files. This occurs because three API callbacks lack authentication and validation, enabling remote code execution. The vulnerability is critical with a CVSS score of 9.8.
GeoNode versions prior to 5.0.3 contain a vulnerability that allows low-privileged remote users to bypass upload validation and store malicious files. This unrestricted file upload flaw is addressed in version 5.0.3.
A vulnerability in Avast Antivirus and related products allows a local attacker running inside the Avast sandbox on Windows to write files outside the sandbox containment. This occurs due to improper validation in the sandbox's file virtualization layer, enabling arbitrary file writes to protected system locations. Exploitation can lead to overwriting executables or system libraries, resulting in code execution with host privileges after system operations or reboot.
The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the download_one_file function. This is due to missing file extension whitelist and MIME type validation in download_one_file() when writing files derived from attacker-controlled manifest entries to the web-served plugin directory. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible when the plugin's apiType setting is configured as custom-local (self-hosted model mode), a non-default option that requires a paid license and prints the REST nonce and one-time session tokens into every front-end page.
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.
The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission form, and the stored path is disclosed in the response. By default the uploaded file is served as static content, so the primary impact is an unauthenticated arbitrary file write to a web-accessible directory, which allows hosting of attacker-controlled content (for example phishing or malware pages) under the victim's domain.
Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unprivileged file upload, leading to full RCE.
The NextGEN Gallery plugin for WordPress (versions up to 4.4.1) contains a vulnerability that allows authenticated users with custom-level access or higher to execute remote code on the server. This is due to unrestricted file upload and unsafe handling of image metadata combined with a bypassable signature check. Attackers must own at least one gallery, a condition that can persist even after capability revocation.
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications WordPress plugin up to version 3.10.2 has an arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to upload potentially executable files by bypassing file extension and MIME type validation using a trailing-dot filename. The vulnerability arises from missing server-side file key allowlist and improper sanitization in the handle_upload function. The only access control is a nonce embedded in public forms, which is easily accessible to any visitor. This can lead to remote code execution on affected installations.
The Project Manager – AI Powered plugin for WordPress up to version 4.1.1 contains a critical vulnerability that allows unauthenticated remote code execution. This occurs because the 'id' parameter is unsanitized and used directly in a dynamic PHP function call without validation, bypassing authorization checks. The flaw enables attackers to execute arbitrary code on the server, posing a severe risk to confidentiality, integrity, and availability.
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function. This is due to broken authorization on the Lightroom gallery_edit endpoint combined with mass assignment of gallery path and unrestricted file upload into a registered template directory, whose extension check uses a substring match that accepts sanitized .php_ filenames as valid templates. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to be the stored author of at least one existing NextGEN gallery, as ownership of that gallery is the sole authorization check gating the mass-assignment and upload steps.
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing uploaded files. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
CVE-2026-61738 is a critical path traversal vulnerability in socfortress CoPilot versions prior to 0.1.77. The flaw exists in the POST /api/scoutsuite/generate-gcp-report endpoint, where an unsanitized filename from a multipart upload is used to save files without proper path containment checks. This allows an attacker with admin or analyst privileges to write files outside the intended directory, potentially overwriting application source files. The vulnerability was fixed in version 0.1.77 by removing caller-controlled filenames from the affected route. The vulnerability has a CVSS score of 10.0, indicating critical severity, but there are no known exploits in the wild at this time.
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a vulnerability allowing arbitrary file upload and overwriting of files in a temporary folder. This flaw could enable execution of embedded JavaScript when an authenticated user downloads the uploaded file. The issue is fixed in PROTECTELMAJ version 6.5.19 and BDF version 6.4.67.