CVE-2026-108811: WMCMS index.php information disclosure
A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access to the affected WMCMS instance and low-privilege access, as reflected by the PR:L metric. No user interaction is required.
What is the impact of successful exploitation?
Successful exploitation can disclose information through manipulation of the path/file argument handled by /index.php. The available data indicates confidentiality impact is low, with no integrity or availability impact.
Is public exploit material available?
Yes. The exploit has been publicly disclosed and could be used in attacks.