Executive brief
AREA 17 Twill CMS, a content management system for Laravel, contains a security flaw in its media library. An authenticated user with basic content-authoring permissions (such as the 'Publisher' role) can upload malicious files, including PHP scripts, to the server. Because these files are stored in a publicly accessible folder, an attacker can execute them to take control of the web server, access the database, or steal sensitive configuration data.
Technical details
An unrestricted file upload vulnerability exists in AREA 17 Twill CMS up to version 3.6.0 within the FileLibraryController::storeFile function. The application fails to validate file extensions or MIME types for uploads handled by the Media Library Insert Page, specifically via the 'qqfilename' argument. An authenticated attacker with 'Publisher' or 'Admin' roles (possessing the 'edit-media-library' permission) can upload a PHP shell. Since the default configuration stores these files in a web-accessible directory ('storage/app/public/uploads') with public visibility, the attacker can achieve remote code execution (RCE) by directly requesting the uploaded file's URL. The vendor has reportedly not responded to the disclosure.
Affected products
- AREA 17 Twill CMS up to 3.6.0
Timeline
- 2026-06-05: disclosed: Initial disclosure by Bytium researchers
- 2026-07-13: advisory: CVE published to NVD dataset