CVE-2026-112027

Received Received - Intake

File and Directory Exposure in Light0011 CMS via Uploadify

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulDB

Description

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file_exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the argument filename results in file and directory information exposure. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-112027

EUVD

EUVD-2026-104010

Affected Vendors & Products

Vendor	Product	Version / Range
light0011	cms	c774dce31c6df0055568a8d5c53d964d99be199d
light0011	cms	f72cf46f601efb2a0618c3814cc2f61380b38930

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-538	The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability is in the light0011 CMS software. It affects the file_exists function in Public/Home/js/uploadify/check-exists.php. An attacker can manipulate the filename argument to expose file and directory information. The exploit is public and can be used remotely.

Detection Guidance

To detect this vulnerability, check for the presence of the affected file Public/Home/js/uploadify/check-exists.php in your light0011 CMS installation. Verify if the file_exists function is exposed to file and directory information leaks. Use commands like 'find / -name check-exists.php' to locate the file and inspect its contents for improper handling of the filename argument.

Impact Analysis

An attacker could gain access to sensitive file and directory information on your server. This may lead to further attacks like unauthorized access or data leaks. The impact is moderate as it only exposes information without direct modification.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR or HIPAA compliance. Exposure of file information may indicate insufficient security controls, risking regulatory penalties.

Mitigation Strategies

Immediately remove or restrict access to the vulnerable file Public/Home/js/uploadify/check-exists.php. Update the light0011 CMS to the latest version if available. Implement input validation for the filename argument in the file_exists function. Monitor network traffic for suspicious requests targeting this file.

Hi! I’m here to help you understand CVE-2026-112027. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70