High 8.8Published Oct 3, 2026

CVE-2026-105123W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

Updated under an hour ago (Oct 28, 2026, 7:20 AM ET)

Does this affect you?

It affects vincent-peugnet wcms. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.52%, higher than 43% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for vincent-peugnet wcms

Exploited in the last 30 days

W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path].

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-434
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.52% (percentile 43)
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

vincent-peugnet wcms vincent_peugnet:wcms (from the name)	through 3.18.0	CNA record

References

References

https://github.com/vincent-peugnet/wcms/issues/662	issue-tracking
https://github.com/vincent-peugnet/wcms	product
https://github.com/vincent-peugnet/wcms/blob/cda5bcdb95dbdb1e804fdfe0e5fd2e2b2f8a90e2/app/class/Controllerapimedia.php#L24-L44	technical-description
https://github.com/vincent-peugnet/wcms/blob/cda5bcdb95dbdb1e804fdfe0e5fd2e2b2f8a90e2/app/class/Media.php#L98	technical-description
https://www.vulncheck.com/advisories/w-wcms-through-3.18.0-rce-and-arbitrary-file-write-via-media-upload-api	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.