CVE-2026-110025

slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload

State: Published
Severity: 6.9 Medium
Published: Oct 13, 2026
Updated: Oct 15, 2026
Reserved: Oct 13, 2026

Description

A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-434 Unrestricted Upload
CWE-284 Improper Access Controls

Affected Products

Product	Versions
phpwcmsslackero	1.9.0Affected 1.9.1Affected 1.9.2Affected 1.9.3Affected 1.9.4Affected 1.9.5Affected 1.9.6Affected 1.9.7Affected 1.9.8Affected 1.9.9Affected 1.9.10Affected 1.9.11Affected 1.9.12Affected 1.9.13Affected 1.9.14Affected 1.9.15Affected 1.9.16Affected 1.9.17Affected 1.9.18Affected 1.9.19Affected 1.9.20Affected 1.9.21Affected 1.9.22Affected 1.9.23Affected 1.9.24Affected and 31 more versions

References

VDB-417752 | slackero phpwcms Extension Check cnt23.article.inc.php unrestricted uploadvdb-entrytechnical-description
VDB-417752 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-110025 | CVE Analysis and Reportthird-party-advisory
Submit #992814 | slackero phpwcms <= 1.12.3 Unrestricted Upload / Remote Code Execution (CWE-434)third-party-advisory
https://github.com/slackero/phpwcms/security/advisories/GHSA-2c7r-324f-fxm4related
https://github.com/slackero/phpwcms/commit/f4c136b467565b2d16ebe2b8276b9a03547a9a69patch
https://github.com/slackero/phpwcms/releases/tag/v1.12.4patch
https://github.com/slackero/phpwcms/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.