CVE-2026-86308
Received Received - Intake

Information Disclosure in Light0011 CMS via Debug Mode

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Common/Conf/config.php of the component Debug Mode. The manipulation of the argument DB_DEBUG results in information disclosure. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86308
EUVD
EUVD-2026-72405

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
light0011 cms to f72cf46f601efb2a0618c3814cc2f61380b38930 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86308 is an information disclosure vulnerability in a CMS application where debug mode is permanently enabled in production. This exposes sensitive framework paths, stack traces, and internal details to remote users when exceptions occur. The issue stems from misconfigurations in APP_DEBUG and DB_DEBUG settings in specific files.

Detection Guidance

Check if debug mode is enabled by inspecting the config.php file for DB_DEBUG set to True and index.php for APP_DEBUG set to True. Look for exposed stack traces or framework paths in error responses from the CMS.

Impact Analysis

Attackers can remotely access detailed internal information about the framework, including filesystem paths, line numbers, versions, and call stacks. This reduces attack complexity by helping attackers map the system and identify other vulnerabilities to exploit.

Compliance Impact

This vulnerability exposes sensitive internal framework details such as source paths, stack traces, and database errors to remote users. This could lead to non-compliance with GDPR by failing to protect personal data processing information and HIPAA by revealing system configurations that may compromise protected health information security.

Mitigation Strategies

Disable debug mode by setting APP_DEBUG and DB_DEBUG to False in production. Ensure detailed exceptions are logged server-side and only generic error messages are shown to users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86308. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart