CVE-2026-1107: EyouCMS Member Avatar Diyajax.php check_userinfo unrestricted upload
A weakness has been identified in EyouCMS up to 1.7.1/5.0. Impacted is the function checkuserinfo of the file Diyajax.php of the component Member Avatar Handler. Executing a manipulation of the argument viewfile can lead to unrestricted upload. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1107?
CVE-2026-1107 has a high severity due to its potential for unrestricted file uploads that can lead to unauthorized access.
How do I fix CVE-2026-1107?
To fix CVE-2026-1107, update EyouCMS to the latest version beyond 1.7.1 to avoid the vulnerability.
Which versions of EyouCMS are affected by CVE-2026-1107?
EyouCMS versions up to and including 1.7.1 are affected by CVE-2026-1107.
What type of vulnerability is CVE-2026-1107?
CVE-2026-1107 is an unrestricted file upload vulnerability found in the Member Avatar Handler of EyouCMS.
What is the impact of exploiting CVE-2026-1107?
Exploiting CVE-2026-1107 can allow an attacker to upload arbitrary files, potentially leading to system compromise.