CyberRota Analysis
AI-GeneratedAuthenticated editors using versions up to 3.18.0 of the W CMS are vulnerable to a remote code execution flaw that allows them to upload arbitrary files, including malicious PHP scripts, by exploiting unvalidated paths in the media upload API. This vulnerability can lead to unauthorized file execution and deletion, posing a significant risk to the integrity and security of the web application. Organizations utilizing this CMS should prioritize patching this vulnerability to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path].