Executive brief
Textpattern CMS, a popular open-source content management system, is vulnerable to a security flaw in its plugin management system. An attacker with basic user credentials can upload malicious files to the server, allowing them to take full control of the website and its underlying data. This could lead to complete service disruption, data theft, or the use of the server to launch further attacks.
Technical details
An authenticated remote code execution (RCE) vulnerability exists in Textpattern CMS 4.9.0-dev due to insufficient validation in the plugin upload functionality. An attacker with low-privileged authentication can bypass security checks by retrieving a valid CSRF token from the plugin event page and then uploading a malicious PHP file. The application stores these uploaded files in the 'textpattern/tmp/' directory, where they can be directly accessed and executed by the attacker. This allows for arbitrary command execution on the underlying server. The issue is reportedly addressed in version 4.9.1.
Affected products
- Textpattern Textpattern CMS 4.9.0-dev
Timeline
- 2021-07-04: other: Exploit code published on Exploit-DB
- 2026-02-14: patched: Textpattern 4.9.1 released with security fixes
- 2026-05-16: disclosed: CVE published to NVD