Unauthenticated .phtml Upload RCE in phpwcms (CVE-2026-110025)

Unauthenticated .phtml File Upload Leads to Remote Code Execution Vulnerability Overview The public form content section of phpwcms (content type 23) accepts uploaded files whose extensions are not on a configurable deny list. The default deny list does not include and other server-related executable extensions; therefore, files submitted through the standard public form are stored in the accessible directory while retaining their dangerous extensions. On web servers that map to the PHP processor (the standard Apache/mod_php configuration in Debian and its derivatives), the uploaded file is executed as PHP code. Affected Versions Affected Versions: - phpwcms >= 1.9.0, = 1.10.0, <= 1.12.3 - phpwcms 2.0.0-dev Impact: - Unauthenticated attackers can execute PHP code with the privileges of the web server account. - Depending on the deployment configuration, this may allow reading phpwcms configuration and database credentials, reading or modifying CMS content and user data, creating or modifying administrator accounts, modifying writable files via database access, or accessing sensitive information within PHP or web server processes. Remediation Patch Versions: - phpwcms 1.9.50 - phpwcms 1.12.4 - phpwcms 2.0.0-dev Patch Commits: - 1.9.x (legacy): 11bc978438f5a968b3053f5f6e502c7ae8ff711f - 1.10.x - 1.12.x: f4c130b467505b2b1e2b827609d35f42a9d9 - 2.x (development): B573cb47fd6668041e88a831aaf4513e37 Fix Details: - The default upload extension deny list now includes , , , , and other script and executable file types (e.g., cgi, pl, py, sh, bash, ini, env, conf, bak, sql, etc.). - The deny list is enforced unconditionally on the server side, regardless of the form's custom / settings. - Each uploaded file is validated via MIME type ( ) and checked for PHP open tags. - The distributed disables all script and executable extensions using (Apache 2.4) and falls back to (Apache 2.2), PHP execution engine is disabled, and is set. Workarounds If immediate upgrade is not possible, the following temporary measures can be taken: - Configure an explicit allowlist on the upload fields of each publicly accessible form, limited to only the extensions actually required. - Block execution of script and executable extensions at the web server level, at minimum covering , , , , , etc., and disable PHP execution. - Remove the upload field from publicly accessible forms prior to upgrading the application. References CVE-2026-110025 GitHub Advisory: GHSA-2c7r-324f-fxm4 VulDB: VDB-417752

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated .phtml Upload RCE in phpwcms (CVE-2026-110025)

More from this source