CVE-2026-6561: EyouCMS Index.php edit_adminlogo unrestricted upload
A vulnerability was detected in EyouCMS up to 1.7.1. This issue affects the function editadminlogo of the file application/admin/controller/Index.php. Performing a manipulation of the argument filename results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6561?
CVE-2026-6561 is rated as a high severity vulnerability due to its unrestricted upload feature.
How do I fix CVE-2026-6561?
To fix CVE-2026-6561, update EyouCMS to version 1.7.2 or later.
What systems are affected by CVE-2026-6561?
CVE-2026-6561 affects EyouCMS versions up to and including 1.7.1.
What type of vulnerability is CVE-2026-6561?
CVE-2026-6561 is an unrestricted file upload vulnerability.
Can CVE-2026-6561 lead to remote code execution?
Yes, exploiting CVE-2026-6561 can potentially allow an attacker to execute arbitrary code remotely.