Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92895— Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter

Quick assessment

Affected
jiangweifang Live2DWebCanvas
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Live2DWebCanvas 插件在所有 2.2.1 及更早版本中，因 函数存在任意文件上传漏洞。该漏洞源于 在将攻击者控制的清单条目所生成的文件写入由 Web 服务器提供的插件目录时，缺少文件扩展名白名单和 MIME 类型验证。这使得未认证的攻击者能够上传可能可执行的文件；当插件的 设置配置为 （即自托管模型模式，这是一种非默认选项，需付费许可证，且会在每个前端页面中输出 REST 随机数（nonce）和一次性会话令牌）时，攻击者可借此实现远程代码执行。

CVSS 8.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92895

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the download_one_file function. This is due to missing file extension whitelist and MIME type validation in download_one_file() when writing files derived from attacker-controlled manifest entries to the web-served plugin directory. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible when the plugin's apiType setting is configured as custom-local (self-hosted model mode), a non-default option that requires a paid license and prints the REST nonce and one-time session tokens into every front-end page.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
jiangweifang Live2DWebCanvas 0 ~ 2.2.1 -

II. Public POCs for CVE-2026-92895

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92895

请登录查看更多情报信息。

Other References for CVE-2026-92895 (7)

IV. Related Vulnerabilities

Same product: Live2DWebCanvas
Same vendor: jiangweifang
Same weakness: CWE-434