CVE-2026-88419
Received Received - Intake

Unrestricted File Upload in WuzhiCMS

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: MITRE

Description
An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file extension is taken verbatim from the client-supplied filename with no extension allowlist or content validation and the file is written to the web-accessible uploadfile/ directory, from which the web server executes PHP.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-23
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-88419
EUVD
EUVD-2026-84851

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wuzhicms wuzhicms 5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a malicious .php file via the thumbnail-upload endpoint. The file is stored in a web-accessible directory without validating the extension or content, enabling arbitrary PHP code execution on the server.

Detection Guidance

Check for unexpected .php files in the www/uploadfile/ directory of WuzhiCMS 5.0.0. Look for files uploaded via the thumbnail-upload or avatar-upload endpoints without proper validation. Review server access logs for POST requests to /index.php?m=member&f=article&v=thumbUpload or /member/user.php?setAvatar.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your server, potentially taking full control of the system, stealing data, or installing malware. The impact includes unauthorized access, data breaches, and server compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Restrict access to vulnerable endpoints, block .php file uploads via WAF or server rules, and disable script execution in the upload directory. Consider storing uploads outside the web root and implement strict extension allowlists and content validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88419. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart