CVE-2026-15518

MEDIUM 4.7

AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload

CVSS Score

4.7

EPSS Score

0.2%

EPSS Percentile

16th

A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Admin/FileLibraryController.php of the component Media Library Insert Page. Such manipulation of the argument qqfilename leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-434 CWE-284
Vendor	area 17
Product	twill cms
Published	Jul 13, 2026
Last Updated	Jul 13, 2026

Stay Ahead of the Next One

Get instant alerts for area 17 twill cms

Be the first to know when new medium vulnerabilities affecting area 17 twill cms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

AREA 17 / Twill CMS

3.0 3.1 3.2 3.3 3.4 3.5 3.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/377847 vuldb.com: https://vuldb.com/vuln/377847/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15518 vuldb.com: https://vuldb.com/submit/849572 bytium.com: https://bytium.com/insights/authenticated-arbitrary-file-upload-to-rce-in-twill-cms

Credits

Jobyer Ahmed 🔍 suffer (VulDB User) VulDB CNA Team