CVE-2026-86668: aircheng-org iWebShop-5 pic.php uploadFile cross site scripting
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker can perform the attack remotely by manipulating the outerSrc or selectPhoto argument handled by uploadFile in controllers/pic.php. The CVSS vector indicates no privileges are required, but user interaction is required.
Which deployments are affected?
The issue affects aircheng-org iWebShop-5 through version 5.15. The provided information does not identify any configuration requirement or indicate that a default configuration is excluded.
Is exploit code or public exploitation information available?
The exploit has been publicly disclosed and may be used. The project was notified through an issue report but had not responded at the time of publication.