Executive brief
Rhymix is a content management system used to build and manage websites. Versions before 2.1.31 contain a flaw that allows attackers to access arbitrary files by manipulating extra variables in file upload fields, potentially exposing sensitive data stored on the server.
Technical details
The vulnerability is an insecure direct object reference (IDOR) affecting boards that use the "file upload" format for extra variables, introduced in version 2.1.18. Attackers can craft requests with malicious extra variables to reference and retrieve arbitrary files from the system without proper authorization checks. The attack does not require authentication or user interaction beyond the ability to submit a request. The vulnerability was patched in version 2.1.31, where file upload validation was enhanced to prevent unauthorized file references.
Affected products
- Rhymix Rhymix before 2.1.31
Timeline
- 2026-09-13: disclosed: CVE-2026-36453 published on NVD
- 2026-02-16: patched: Fix committed to repository
- 2026-02-26: advisory: Rhymix 2.1.31 released with security patch