HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-105123 — W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnera...

·Source: NIST NVD

Updated:

Executive Summary

W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path

Analysis

W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path]. CVSS Score: 8.8. Published: 2026-10-04T00:16:35.703.

Indicators of Compromise (1)

CVE (1)
CVE-2026-105123
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 4, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

User Agent Strings Curiosities, (Sun, Oct 4th)

Sometimes I have to smile, or my interest is triggered, when I review new User Agent Strings in the honeypot logs.

SANS ISC
MEDIUMVulnerability

ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members

A suspected member of the ShinyHunters digital extortion group, who goes by the online alias "Rey," has been allegedly detained by authorities in Jordan, Reuters reported, citing three people familiar with the matter. Rey, whose real name is Saif ‌al-Din Khader, is said to have been brought into custody on September 29, 2026, cooperating with the U.S. Federal Bureau of Investigation (FBI) and

The Hacker News
CRITICALVulnerability

NVD CRITICAL: CVE-2026-105135 — A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects ...

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure

CVE-2026-105135
NIST NVD