CVE-2026-86305
Received Received - Intake

Unrestricted File Upload in Light0011 CMS

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86305
EUVD
EUVD-2026-72376

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
light0011 cms *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unrestricted file upload flaw in light0011 CMS. The issue lies in the Upload::upload function of ThinkPHP/Library/Think/Upload.class.php, where no restrictions are enforced on file types, sizes, or authentication. Attackers can remotely upload malicious files, potentially leading to remote code execution or hosting malicious content.

Detection Guidance

Check for unauthorized file uploads in your web application directories, particularly in ThinkPHP-based CMS installations. Look for files with unusual extensions or names in upload directories. Review server logs for POST requests to upload endpoints like /Home/upload or similar paths. Use tools like curl to test the upload endpoint: curl -X POST -F 'file=@test.php' http://target.com/Home/upload. Monitor for unexpected PHP or executable files in web-accessible directories.

Impact Analysis

This vulnerability allows attackers to upload arbitrary files to your server without authentication. If the server executes uploaded files, it could lead to remote code execution, compromising your system. Even if files are stored in object storage, attackers could host malicious files or perform phishing attacks.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Non-compliance may result in legal penalties, reputational damage, and loss of trust from users or clients.

Mitigation Strategies

Immediately enforce authentication for all upload actions. Whitelist allowed file types and sizes in the ThinkPHP Upload class configuration. Generate server-side filenames to prevent path traversal. Store uploaded files outside the web root directory. Configure the web server to block execution of files in upload directories. Update ThinkPHP and disable default permissive file policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86305. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart