# CVE-2026-15530: WuzhiCMS Attachment API information disclosure

Source: https://junglewise.ai/threats/cve-2026-15530-wuzhicms-attachment-api-information-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-15530 · Severity: medium · CVSS 5.3 · Published 2026-07-13

WuzhiCMS, a content management system, contains a security flaw in its Attachment API. This vulnerability allows an unauthorized person to access sensitive configuration information or file lists without needing a password. An attacker could use this information to gain insights into the website's structure or stored files, potentially leading to further attacks. As of the latest report, the software developer has not yet released a fix.

Technologies: [WuzhiCMS](https://junglewise.ai/threats/technologies/wuzhicms). Vendors: [WuzhiCMS](https://junglewise.ai/threats/vendors/wuzhicms).

## Quick answers

**Is CVE-2026-15530 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15530 being exploited in the wild.

**How severe is CVE-2026-15530?** Medium severity, with a CVSS score of 5.3, published 13 July 2026.

**Which products and versions are affected?** WuzhiCMS up to 4.1.0.

**Is there a fix for CVE-2026-15530?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15530 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-15530?** Check whether you run WuzhiCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in WuzhiCMS versions up to 4.1.0 within the Attachment API component. The flaw is located in the config/listimage function of the /index.php?m=attachment&f=index&v=upload endpoint. The root cause is a failure to implement proper authorization checks (CWE-862), allowing unauthenticated remote attackers to trigger the 'action=config' parameter. Successful exploitation enables an attacker to retrieve sensitive system configuration details and file listings. A proof-of-concept has been published, and while the vendor was notified via a GitHub issue, no patch is currently available.

## Affected products

- WuzhiCMS WuzhiCMS up to 4.1.0

## Timeline

- 2026-07-13: advisory: Initial disclosure by VulDB/NVD
- 2026-07-13: disclosed: Public issue report on GitHub

## References

- [https://github.com/wuzhicms/wuzhicms/](https://github.com/wuzhicms/wuzhicms/)
- [https://github.com/wuzhicms/wuzhicms/issues/217](https://github.com/wuzhicms/wuzhicms/issues/217)
- [https://vuldb.com/cve/CVE-2026-15530](https://vuldb.com/cve/CVE-2026-15530)
- [https://vuldb.com/submit/854588](https://vuldb.com/submit/854588)
- [https://vuldb.com/vuln/377873](https://vuldb.com/vuln/377873)
- [https://vuldb.com/vuln/377873/cti](https://vuldb.com/vuln/377873/cti)

## Related threats

- [WuzhiCMS unrestricted file upload in thumbnail endpoint](https://junglewise.ai/threats/cve-2026-88419-an-unrestricted-upload-of-files-with-a-dangerous-type-in-the)
- [WuzhiCMS open redirect in member login](https://junglewise.ai/threats/cve-2026-94102-a-flaw-has-been-found-in-wuzhicms-up-to-4-1-0-this-affects-an)
- [WuzhiCMS remote image fetch server-side request forgery](https://junglewise.ai/threats/cve-2026-92380-wuzhicms-remote-image-fetch-server-side-request-forgery)
- [WuzhiCMS arbitrary file upload via avatar function](https://junglewise.ai/threats/cve-2026-91849-wuzhicms-arbitrary-file-upload-via-avatar-function)
- [WuzhiCMS SQL injection in article::getDataOfJson](https://junglewise.ai/threats/cve-2026-91848-wuzhicms-sql-injection-in-article-getdataofjson)