Executive brief
WuzhiCMS, a content management system, contains a security flaw in its Attachment API. This vulnerability allows an unauthorized person to access sensitive configuration information or file lists without needing a password. An attacker could use this information to gain insights into the website's structure or stored files, potentially leading to further attacks. As of the latest report, the software developer has not yet released a fix.
Technical details
An information disclosure vulnerability exists in WuzhiCMS versions up to 4.1.0 within the Attachment API component. The flaw is located in the config/listimage function of the /index.php?m=attachment&f=index&v=upload endpoint. The root cause is a failure to implement proper authorization checks (CWE-862), allowing unauthenticated remote attackers to trigger the 'action=config' parameter. Successful exploitation enables an attacker to retrieve sensitive system configuration details and file listings. A proof-of-concept has been published, and while the vendor was notified via a GitHub issue, no patch is currently available.
Affected products
- WuzhiCMS WuzhiCMS up to 4.1.0
Timeline
- 2026-07-13: advisory: Initial disclosure by VulDB/NVD
- 2026-07-13: disclosed: Public issue report on GitHub