W (wcms): Remote code execution via media upload API
Summary
W (wcms) through version 3.18.0 contains a path traversal flaw in the media API (POST /api/v0/media/upload/ and DELETE /api/v0/media/). An authenticated editor can upload PHP files that the web server executes, write files outside the media directory using encoded ../ sequences, and delete arbitrary files. The attack requires a valid editor account; no user interaction is needed.
Affected
- W (wcms) versions 0 to 3.18.0 (per CVE record)
Fixed in
Unknown. No fixed version has been published by the vendor. The commit cda5bcdb95dbdb1e804fdfe0e5fd2e2b2f8a90e2 is cited as containing the vulnerable code and should not be treated as a fix.
Workaround
- Restrict editor accounts and the media upload API to trusted networks where feasible.
- Disable server-side script execution in the media directory.
- Ensure the web service account cannot write to application code.
Exploitation
- No known exploitation in the wild.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- A public researcher issue (#662) provides file and line-level detail; no public proof of concept was confirmed.
Our recommendation
- Check whether W (wcms) 3.18.0 or earlier is in use, especially on internet-facing instances with editor accounts.
- Restrict editor accounts to trusted users and review them for unrecognised accounts.
- Restrict access to the media API and disable PHP execution in the media directory.
- Back up the instance and review media folders for unexpected PHP files.
- Monitor for PHP files outside expected locations, traversal sequences in upload requests and unexpected deletions.
- Check the NVD record and the vendor repository for a fixed release and apply it as soon as it is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record: VulnCheck advisory www.vulncheck.com
- GitHub issue #662 (researcher report) github.com
- Controllerapimedia.php at cda5bcd github.com
- Media.php at cda5bcd github.com
- W (wcms) GitHub repository github.com
- OSV entry CVE-2026-105123 osv.dev
- Red Packet Security CVE alert www.redpacketsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:41.
Original description (NVD)
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path].
NVD references (5)
- https://github.com/vincent-peugnet/wcms
- https://github.com/vincent-peugnet/wcms/blob/cda5bcdb95dbdb1e804fdfe0e5fd2e2b2f8a90e2/app/class/Controllerapi…
- https://github.com/vincent-peugnet/wcms/blob/cda5bcdb95dbdb1e804fdfe0e5fd2e2b2f8a90e2/app/class/Media.php#L98
- https://github.com/vincent-peugnet/wcms/issues/662
- https://www.vulncheck.com/advisories/w-wcms-through-3.18.0-rce-and-arbitrary-file-write-via-media-upload-api
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.