CVE-2026-105123: W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[:path].
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with editor-level access can exploit the affected Media Upload API. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What does an attacker need to do to achieve code execution?
The attacker needs to authenticate as an editor and submit a PHP file to POST /api/v0/media/upload/[*:path]. If the web server executes uploaded PHP files, the uploaded file can be used for remote code execution.
Can the issue affect files outside the media directory?
Yes. Encoded ../ path sequences can be used with the upload endpoint to write files outside the intended media directory. The DELETE /api/v0/media/[*:path] endpoint can also be abused to delete arbitrary files.
Which versions are affected?
W (wcms) through version 3.18.0 is affected.