CVE-2026-105123
W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path].
| CWE | CWE-434 |
| Vendor | vincent-peugnet |
| Product | wcms |
| Published | Oct 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for vincent-peugnet wcms
Be the first to know when new high vulnerabilities affecting vincent-peugnet wcms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
vincent-peugnet / wcms
0 ≤ 3.18.0
References
github.com: https://github.com/vincent-peugnet/wcms/issues/662 github.com: https://github.com/vincent-peugnet/wcms github.com: https://github.com/vincent-peugnet/wcms/blob/cda5bcdb95dbdb1e804fdfe0e5fd2e2b2f8a90e2/app/class/Controllerapimedia.php#L24-L44 github.com: https://github.com/vincent-peugnet/wcms/blob/cda5bcdb95dbdb1e804fdfe0e5fd2e2b2f8a90e2/app/class/Media.php#L98 vulncheck.com: https://www.vulncheck.com/advisories/w-wcms-through-3.18.0-rce-and-arbitrary-file-write-via-media-upload-api
Credits
ikram-4