Executive brief
Textpattern CMS, a popular open-source content management system, contains a security flaw in its image upload functionality. An attacker with basic user permissions can manipulate file names to save images in unauthorized locations on the web server. This could lead to service disruption or unauthorized access to sensitive server directories.
Technical details
A path traversal vulnerability (CWE-22) exists in Textpattern CMS up to version 4.9.1. The flaw is located within the mt_uploadImage function in the rpc/TXP_RPCServer.php file, which handles XML-RPC requests. An attacker can manipulate the 'file.name' argument to bypass directory restrictions. Exploitation requires low-level authentication (PR:L) and can be performed over the network. Successful exploitation allows an attacker to upload files to arbitrary locations on the server filesystem, potentially leading to remote code execution or data exposure depending on the server configuration. A fix is expected in an upcoming release.
Affected products
- Textpattern Textpattern CMS up to 4.9.1
Timeline
- 2026-04-02: disclosed: Public disclosure of the vulnerability and exploit details.
- 2026-04-02: advisory: NVD and VulDB published the advisory.