CVE-2026-109218: Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass
The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the addmessage function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitizefilename() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can reach the vulnerable upload path; no login or user interaction is required.
What conditions are needed for remote code execution?
The server must use Apache with libapache2-mod-php, which maps .phar files to PHP by default. The attacker must also retrieve the uploaded file during the brief interval before it is deleted by unlink() at the end of the request.
Are installations using the affected plugin version range vulnerable by default?
The arbitrary file upload flaw affects Contact Manager versions through 9.1.2. Remote code execution depends on the specified Apache and libapache2-mod-php configuration and on access to the short-lived uploaded file.