CVE-2026-110025: slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/incfront/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POSTname causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
slackero/phpwcmsto a version that resolves this vulnerability.Fixed in 1.9.50 - Upgrade
Upgrade
slackero/phpwcmsto a version that resolves this vulnerability.Fixed in 1.12.4
Event History
Frequently Asked Questions
Which deployments are affected?
slackero phpwcms versions up to 1.9.49 and up to 1.12.3 are affected. Versions 1.9.50 and 1.12.4 are identified as upgrades that address the issue.
Can this be exploited remotely without credentials or user interaction?
Yes. The supplied vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.
What input is involved in exploitation?
The issue is triggered through manipulation of the POST_name argument in include/inc_front/content/cnt23.article.inc.php, within the Extension Check component. The reported impact is unrestricted file upload.
What should be done if the affected component is in use?
Upgrade the affected phpwcms component to version 1.9.50 or 1.12.4. The provided patch identifiers are 118c978430f5a9668b30535f6e592c7ae8df711f, f4c136b467565b2d16ebe2b8276b9a03547a9a69, and 8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7.