CVE-2026-110025

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110025
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110025.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110025
Aliases
  • GHSA-2c7r-324f-fxm4
Published
2026-10-13T15:41:34Z
Modified
2026-10-14T02:48:38Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
Details

A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-284",
        "CWE-434"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110025.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "1.9.0"
                },
                {
                    "last_affected":  "1.9.0"
                },
                {
                    "introduced":  "1.9.1"
                },
                {
                    "last_affected":  "1.9.1"
                },
                {
                    "introduced":  "1.9.4"
                },
                {
                    "last_affected":  "1.9.4"
                },
                {
                    "introduced":  "1.9.9"
                },
                {
                    "last_affected":  "1.9.9"
                },
                {
                    "introduced":  "1.9.10"
                },
                {
                    "last_affected":  "1.9.10"
                },
                {
                    "introduced":  "1.9.14"
                },
                {
                    "last_affected":  "1.9.14"
                },
                {
                    "introduced":  "1.9.31"
                },
                {
                    "last_affected":  "1.9.31"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/slackero/phpwcms

Affected ranges

Type
GIT
Repo
https://github.com/slackero/phpwcms
Events
Introduced
989ad0fef69272f3f9e61ff854ec5f796242e329
Last Affected
b8ebd5c8f2e21d187fc006fd8e9f72cfcac9c5cc
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.9.2"
        },
        {
            "last_affected":  "1.9.2"
        },
        {
            "introduced":  "1.9.3"
        },
        {
            "last_affected":  "1.9.3"
        },
        {
            "introduced":  "1.9.5"
        },
        {
            "last_affected":  "1.9.5"
        },
        {
            "introduced":  "1.9.6"
        },
        {
            "last_affected":  "1.9.6"
        },
        {
            "introduced":  "1.9.7"
        },
        {
            "last_affected":  "1.9.7"
        },
        {
            "introduced":  "1.9.8"
        },
        {
            "last_affected":  "1.9.8"
        },
        {
            "introduced":  "1.9.11"
        },
        {
            "last_affected":  "1.9.11"
        },
        {
            "introduced":  "1.9.12"
        },
        {
            "last_affected":  "1.9.12"
        },
        {
            "introduced":  "1.9.13"
        },
        {
            "last_affected":  "1.9.13"
        },
        {
            "introduced":  "1.9.15"
        },
        {
            "last_affected":  "1.9.15"
        },
        {
            "introduced":  "1.9.16"
        },
        {
            "last_affected":  "1.9.16"
        },
        {
            "introduced":  "1.9.17"
        },
        {
            "last_affected":  "1.9.17"
        },
        {
            "introduced":  "1.9.18"
        },
        {
            "last_affected":  "1.9.18"
        },
        {
            "introduced":  "1.9.19"
        },
        {
            "last_affected":  "1.9.19"
        },
        {
            "introduced":  "1.9.20"
        },
        {
            "last_affected":  "1.9.20"
        },
        {
            "introduced":  "1.9.21"
        },
        {
            "last_affected":  "1.9.21"
        },
        {
            "introduced":  "1.9.22"
        },
        {
            "last_affected":  "1.9.22"
        },
        {
            "introduced":  "1.9.23"
        },
        {
            "last_affected":  "1.9.23"
        },
        {
            "introduced":  "1.9.24"
        },
        {
            "last_affected":  "1.9.24"
        },
        {
            "introduced":  "1.9.25"
        },
        {
            "last_affected":  "1.9.25"
        },
        {
            "introduced":  "1.9.26"
        },
        {
            "last_affected":  "1.9.26"
        },
        {
            "introduced":  "1.9.27"
        },
        {
            "last_affected":  "1.9.27"
        },
        {
            "introduced":  "1.9.28"
        },
        {
            "last_affected":  "1.9.28"
        },
        {
            "introduced":  "1.9.29"
        },
        {
            "last_affected":  "1.9.29"
        },
        {
            "introduced":  "1.9.30"
        },
        {
            "last_affected":  "1.9.30"
        },
        {
            "introduced":  "1.9.32"
        },
        {
            "last_affected":  "1.9.32"
        },
        {
            "introduced":  "1.9.33"
        },
        {
            "last_affected":  "1.9.33"
        },
        {
            "introduced":  "1.9.34"
        },
        {
            "last_affected":  "1.9.34"
        },
        {
            "introduced":  "1.9.35"
        },
        {
            "last_affected":  "1.9.35"
        },
        {
            "introduced":  "1.9.36"
        },
        {
            "last_affected":  "1.9.36"
        },
        {
            "introduced":  "1.9.37"
        },
        {
            "last_affected":  "1.9.37"
        },
        {
            "introduced":  "1.9.38"
        },
        {
            "last_affected":  "1.9.38"
        },
        {
            "introduced":  "1.9.39"
        },
        {
            "last_affected":  "1.9.39"
        },
        {
            "introduced":  "1.9.40"
        },
        {
            "last_affected":  "1.9.40"
        },
        {
            "introduced":  "1.9.41"
        },
        {
            "last_affected":  "1.9.41"
        },
        {
            "introduced":  "1.9.42"
        },
        {
            "last_affected":  "1.9.42"
        },
        {
            "introduced":  "1.9.43"
        },
        {
            "last_affected":  "1.9.43"
        },
        {
            "introduced":  "1.9.44"
        },
        {
            "last_affected":  "1.9.44"
        },
        {
            "introduced":  "1.9.45"
        },
        {
            "last_affected":  "1.9.45"
        },
        {
            "introduced":  "1.9.46"
        },
        {
            "last_affected":  "1.9.46"
        },
        {
            "introduced":  "1.9.47"
        },
        {
            "last_affected":  "1.9.47"
        },
        {
            "introduced":  "1.9.48"
        },
        {
            "last_affected":  "1.9.48"
        },
        {
            "introduced":  "1.9.49"
        },
        {
            "last_affected":  "1.9.49"
        },
        {
            "introduced":  "1.12.0"
        },
        {
            "last_affected":  "1.12.0"
        },
        {
            "introduced":  "1.12.1"
        },
        {
            "last_affected":  "1.12.1"
        },
        {
            "introduced":  "1.12.2"
        },
        {
            "last_affected":  "1.12.2"
        },
        {
            "introduced":  "1.12.3"
        },
        {
            "last_affected":  "1.12.3"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*
1.12.0
1.12.1
1.12.2
1.12.3
1.9.11
1.9.12
1.9.13
1.9.15
1.9.16
1.9.17
1.9.18
1.9.19
1.9.2
1.9.20
1.9.21
1.9.22
1.9.23
1.9.24
1.9.25
1.9.26
1.9.27
1.9.28
1.9.29
1.9.3
1.9.30
1.9.32
1.9.33
1.9.34
1.9.35
1.9.36
1.9.37
1.9.38
1.9.39
1.9.40
1.9.41
1.9.42
1.9.43
1.9.44
1.9.45
1.9.46
1.9.47
1.9.48
1.9.49
1.9.5
1.9.6
1.9.7
1.9.8
phpwcms-1.*
phpwcms-1.9.2
phpwcms-1.9.3
phpwcms-1.9.5
phpwcms-1.9.6
v1.*
v1.10.2
v1.10.3
v1.10.4
v1.10.5
v1.10.6
v1.10.7
v1.10.8
v1.10.9
v1.11.0
v1.11.1
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.9.11
v1.9.12
v1.9.13
v1.9.15
v1.9.16
v1.9.17
v1.9.18
v1.9.19
v1.9.20
v1.9.21
v1.9.22
v1.9.23
v1.9.24
v1.9.25
v1.9.26
v1.9.27
v1.9.28
v1.9.29
v1.9.30
v1.9.32
v1.9.33
v1.9.34
v1.9.35
v1.9.36
v1.9.37
v1.9.38
v1.9.7
v1.9.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110025.json"