CVE-2026-86666

Deferred Deferred - Pending Action

Unrestricted File Upload in iWebShop

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: VulDB

Description

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_json/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86666

Affected Vendors & Products

Vendor	Product	Version / Range
aircheng-org	iwebshop	to 5.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is an unrestricted file upload flaw in aircheng-org iWebShop-5 versions up to 5.15. It exists in the upload_json/uploadFile function of the controllers/pic.php file. Attackers can remotely exploit this to upload malicious files without restrictions.

Impact Analysis

An attacker could upload malicious files to your server, potentially leading to remote code execution, data theft, or system compromise. Public exploit availability increases the risk of attacks.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health information security) requirements. Compliance may be compromised if sensitive data is exposed.

Mitigation Strategies

Immediately update iWebShop to the latest version if available. If no update exists, disable the upload_json/uploadFile function in controllers/pic.php. Restrict network access to the vulnerable endpoint and monitor for unusual file uploads or activity.

Hi! I’m here to help you understand CVE-2026-86666. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70