Executive brief
Windu CMS, a platform used for building and managing websites, contains a security flaw in its file upload system. An authorized user can upload malicious files, such as PHP scripts, to the server. This could allow an attacker to take complete control of the website, access sensitive data, or disrupt operations.
Technical details
Windu CMS (confirmed in version 4.1) suffers from an unrestricted file upload vulnerability (CWE-434). The application fails to validate the extensions or content types of files uploaded to the server. An authenticated attacker with basic privileges can upload arbitrary files, including PHP scripts, to a web-accessible directory. By subsequently requesting the uploaded file, the attacker can execute arbitrary code on the underlying server. While the vendor was contacted, no patch has been confirmed, and the vulnerability may persist in other versions.
Affected products
- JCD Windu CMS 4.1
Timeline
- 2026-07-20: disclosed: Vulnerability disclosed by CERT.PL
- 2026-07-20: advisory: CVE-2026-57311 published