Security

Reporting a vulnerability

Please report security vulnerabilities privately — do not open a public issue. See the security policy for how to report.

All published advisories: https://github.com/slackero/phpwcms/security/advisories

CVE-2026-110025 — Unauthenticated .phtml upload leads to remote code execution (Critical)

Published 2026-10-13 — GHSA-2c7r-324f-fxm4, CWE-434. Reported by Fernando Viana (capivara-research).

The public Form content part (content type 23) accepted uploaded files whose extension was not on the denylist. The default denylist did not cover .phtml and other server-dependent executable extensions, so an uploaded file was stored under the web-accessible content/form/ directory with its dangerous extension preserved. On web servers that map such extensions to the PHP handler (standard Apache/mod_php configuration), requesting the uploaded file executed it as PHP code — without any phpwcms account or backend access.

Line	Affected	Fixed in
1.9.x legacy	1.9.0 – 1.9.49	1.9.50
1.10.x – 1.12.x	1.10.0 – 1.12.3	1.12.4
2.x development	up to pre-beta.1 state	2.0.0-beta.1

Preconditions: a published form with an upload field, no explicit accept list for that field, default upload folder content/form/, and a web server that maps an executable extension to a PHP handler.

Update immediately if any publicly reachable form contains an upload field: https://github.com/slackero/phpwcms/releases

If an immediate update is not possible, workarounds and full technical details: https://github.com/slackero/phpwcms/security/advisories/GHSA-2c7r-324f-fxm4