Log in Start free

Vulnerability · Published Jul 13, 2026 · Assigned by VulDB

CVE-2026-15518AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload

Medium 4.7

In plain English

A medium-severity unrestricted file upload in Twill CMS from AREA 17. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.4%top 68.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Admin/FileLibraryController.php of the component Media Library Insert Page. Such manipulation of the argument qqfilename leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

VendorProductVersions
AREA 17 Twill CMS 3.03.13.23.33.43.53.6.0

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References