Vulnerability · Published Oct 3, 2026 · Assigned by VulnCheck

CVE-2026-105123W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

High 8.8

In plain English

A high-severity unrestricted file upload in wcms from vincent-peugnet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 55.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path].

Affected products (as reported)

Vendor	Product	Versions
vincent-peugnet	wcms	0 – through 3.18.0

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Issue #662 issue-tracking
https://github.com/vincent-peugnet/wcms product
https://github.com/vincent-peugnet/wcms/blob/cda5bcdb95dbdb1e804fdfe0e5fd2e2b2f8a90e2/app/class/Controllerapimedia.php#L24-L44 technical-description
https://github.com/vincent-peugnet/wcms/blob/cda5bcdb95dbdb1e804fdfe0e5fd2e2b2f8a90e2/app/class/Media.php#L98 technical-description
VulnCheck Advisory: W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API third-party-advisory