Unrestricted File Upload Vulnerability in Slackero phpwcms Software
CVE-2026-110025

6.9MEDIUM

Key Information:

Vendor

Slackero

Status
PHPwcms
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110025?

A security flaw exists in Slackero phpwcms that enables attackers to exploit the file processing logic within the component Extension Check. Specifically, the manipulation of the POST_name argument can lead to unrestricted file uploads. This vulnerability allows remote attackers to upload potentially malicious files, posing significant risks to the security and integrity of the system. Users are advised to upgrade to versions 1.9.50 or 1.12.4, which contain the necessary patches to resolve this issue.

Affected Version(s)

phpwcms 1.9.0

phpwcms 1.9.1

phpwcms 1.9.2

References

https://vuldb.com/vuln/417752
vdb-entrytechnical-description
https://vuldb.com/vuln/417752/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-110025
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

fernando viana (VulDB User)
.