Executive brief
Writebot is a software template used to build AI-powered content generation websites. A security flaw allows unauthorized individuals to upload malicious files to the server without needing a password. This could allow an attacker to take control of the website, access sensitive data, or disrupt services.
Technical details
An unrestricted file upload vulnerability (CWE-434) exists in the Writebot AI Content Generator SaaS React Template through version 4.0.0. The /file-upload endpoint fails to perform adequate MIME type validation, extension checks, or authentication. An unauthenticated remote attacker can send a crafted POST request to upload a malicious file, such as a PHP shell disguised as an image. If the uploaded file is saved to a publicly accessible directory, the attacker can achieve remote code execution (RCE) and escalate privileges. A public proof-of-concept exploit is available.
Affected products
- Writebot Writebot AI Content Generator SaaS React Template thru 4.0.0
Timeline
- 2025-08-05: advisory: CVE published by MITRE/NVD