CVE-2026-86666: aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload
A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function uploadjson/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
aircheng-org iWebShop-5 versions up to and including 5.15 are identified as affected. The issue is in the upload_json/uploadFile functionality in controllers/pic.php.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
How likely is exploitation in the near term?
A public exploit has been released and may be used in attacks. The exploit maturity is rated as proof-of-concept.
Is a vendor fix available?
The project was notified through an issue report but had not responded at the time of the provided information. No patched version or workaround is specified.