Path Traversal Vulnerability in Textpattern XML-RPC Handler

CVE-2026-5344

What is CVE-2026-5344?

A security vulnerability exists in Textpattern versions up to 4.9.1, specifically within the XML-RPC Handler's mt_uploadImage function. The flaw allows unauthorized file path manipulation through the argument file.name, which can lead to path traversal attacks. This vulnerability permits remote exploitation, and although the issue has been publicly disclosed, the vendor has acknowledged it and is expected to release a patch in the near future.

References