{"schema":"threatline.record/2","record":{"id":"CVE-2026-110025","aliases":["GHSA-2c7r-324f-fxm4"],"summary":"slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload","details":"A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 118c978430f5a9668b30535f6e592c7ae8df711f/f4c136b467565b2d16ebe2b8276b9a03547a9a69/8571cb47df8d66804d1eb88ae3d1ab4fb513e1e7. Upgrading the affected component is recommended.","categories":["Unclassified"],"product":"phpwcms","vendor":"slackero","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110025","source_modified_at":"2026-10-15T15:11:53.863Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"phpwcms","vendor":"slackero","versions":[{"status":"affected","version":"1.9.0"},{"status":"affected","version":"1.9.1"},{"status":"affected","version":"1.9.2"},{"status":"affected","version":"1.9.3"},{"status":"affected","version":"1.9.4"},{"status":"affected","version":"1.9.5"},{"status":"affected","version":"1.9.6"},{"status":"affected","version":"1.9.7"},{"status":"affected","version":"1.9.8"},{"status":"affected","version":"1.9.9"},{"status":"affected","version":"1.9.10"},{"status":"affected","version":"1.9.11"},{"status":"affected","version":"1.9.12"},{"status":"affected","version":"1.9.13"},{"status":"affected","version":"1.9.14"},{"status":"affected","version":"1.9.15"},{"status":"affected","version":"1.9.16"},{"status":"affected","version":"1.9.17"},{"status":"affected","version":"1.9.18"},{"status":"affected","version":"1.9.19"},{"status":"affected","version":"1.9.20"},{"status":"affected","version":"1.9.21"},{"status":"affected","version":"1.9.22"},{"status":"affected","version":"1.9.23"},{"status":"affected","version":"1.9.24"},{"status":"affected","version":"1.9.25"},{"status":"affected","version":"1.9.26"},{"status":"affected","version":"1.9.27"},{"status":"affected","version":"1.9.28"},{"status":"affected","version":"1.9.29"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/slackero/phpwcms/security/advisories/GHSA-2c7r-324f-fxm4","source_modified_at":"2026-10-13T15:30:30Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"other","name":"phpwcms"},"range":">= 1.9.0, < 1.9.50"},{"source":"GitHub Advisory Database","source_url":"https://github.com/slackero/phpwcms/security/advisories/GHSA-2c7r-324f-fxm4","source_modified_at":"2026-10-13T15:30:30Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"other","name":"phpwcms"},"range":">= 1.10.0, <= 1.12.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/slackero/phpwcms/security/advisories/GHSA-2c7r-324f-fxm4","source_modified_at":"2026-10-13T15:30:30Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"other","name":"phpwcms"},"range":"2.0.0-dev"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/slackero/phpwcms/security/advisories/GHSA-2c7r-324f-fxm4","source_modified_at":"2026-10-13T15:30:30Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"other","name":"phpwcms"},"version":"1.9.50"},{"source":"GitHub Advisory Database","source_url":"https://github.com/slackero/phpwcms/security/advisories/GHSA-2c7r-324f-fxm4","source_modified_at":"2026-10-13T15:30:30Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"other","name":"phpwcms"},"version":"1.12.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/slackero/phpwcms/security/advisories/GHSA-2c7r-324f-fxm4","source_modified_at":"2026-10-13T15:30:30Z","fetched_at":"2026-10-24T10:48:42.330819Z","package":{"ecosystem":"other","name":"phpwcms"},"version":"2.0.0-dev"}],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00375,"percentile":0.30307,"score_date":"2026-10-23"},"published_at":"2026-10-13T15:41:34.677Z","modified_at":"2026-10-15T15:11:53.863Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-110025","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T15:11:53.863Z"},{"source":"GitHub Advisory Database","url":"https://github.com/slackero/phpwcms/security/advisories/GHSA-2c7r-324f-fxm4","fetched_at":"2026-10-24T10:48:42.330819Z","source_modified_at":"2026-10-13T15:30:30Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110025","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://vuldb.com/vuln/417752","tags":["vdb-entry","technical-description"]},{"source":"CVE List","url":"https://vuldb.com/vuln/417752/cti","tags":["signature","permissions-required"]},{"source":"CVE List","url":"https://vuldb.com/cve/CVE-2026-110025","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://vuldb.com/submit/992814","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/slackero/phpwcms/security/advisories/GHSA-2c7r-324f-fxm4","tags":["related"]},{"source":"CVE List","url":"https://github.com/slackero/phpwcms/commit/f4c136b467565b2d16ebe2b8276b9a03547a9a69","tags":["patch"]},{"source":"CVE List","url":"https://github.com/slackero/phpwcms/releases/tag/v1.12.4","tags":["patch"]},{"source":"CVE List","url":"https://github.com/slackero/phpwcms/","tags":["product"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-15T14:52:16.401357Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T15:11:53.863Z","content_hash":"72cfb02064df8b1ba5753911782a1c71002add37ee68f33b08fca79e32985762"}}