CVE-2026-108811
Received Received - Intake

Information Disclosure in WMCMS via Path Manipulation

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108811
EUVD
EUVD-2026-97284

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a WMCMS 4.446.1257

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108811 is an arbitrary file read vulnerability in WMCMS version 4.446.1257. It allows remote attackers to read sensitive files on a server by exploiting a flaw in the file download functionality. The issue occurs in the admin module through parameter manipulation in the URL, enabling unauthorized file disclosure.

Detection Guidance

To detect this vulnerability, check for unusual file access patterns or attempts to read sensitive files via the /index.php path in WMCMS 4.446.1257. Monitor server logs for requests containing path/file parameters pointing to sensitive locations like /wmcms/config/data.config.php. Use network traffic analysis tools to inspect HTTP requests targeting the admin module.

Impact Analysis

This vulnerability could allow attackers to access sensitive files such as configuration files, potentially exposing confidential data like credentials or system settings. If exploited, it may lead to further attacks like data breaches or unauthorized system access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. It may result in data breaches, triggering legal penalties, fines, and reputational damage for organizations handling protected information.

Mitigation Strategies

Immediately update WMCMS to the latest patched version if available. If not, restrict access to the admin module by IP whitelisting or disabling it entirely. Implement strict input validation for the path/file parameter in /index.php. Review and remove any exposed sensitive files from web-accessible directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108811. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart