CVE-2026-88419: Malicious File Upload
An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file extension is taken verbatim from the client-supplied filename with no extension allowlist or content validation and the file is written to the web-accessible uploadfile/ directory, from which the web server executes PHP.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privileged member can exploit it. The attacker needs access to the thumbnail-upload endpoint and does not need elevated administrative privileges.
Are deployments affected by default?
The issue depends on the thumbnail-upload endpoint accepting attacker-controlled filenames, storing uploads in the web-accessible uploadfile/ directory, and the web server executing PHP from that directory. The provided information does not establish whether these conditions are present in every default deployment.
What can be done if patching is not immediately possible?
Prevent PHP and other executable files from being executed in the uploadfile/ directory. Restrict the upload endpoint to an allowlist of expected image extensions and validate uploaded file content rather than trusting the client-supplied filename.
How can I check for exploitation?
Review files in the web-accessible uploadfile/ directory for unexpected .php files, especially files uploaded through the thumbnail-upload functionality. Review web server and application logs for requests to /index.php?m=member&f=article&v=thumbUpload and subsequent requests to uploaded PHP files.