# CVE-2026-86308: light0011 CMS information disclosure in debug mode

Source: https://junglewise.ai/threats/cve-2026-86308-light0011-cms-information-disclosure-in-debug-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86308 · Severity: medium · CVSS 5.3 · Published 2026-09-07

light0011 is a news content management system built on ThinkPHP. The application permanently enables debug mode and database debugging in production, causing exceptions and errors to return detailed information including framework paths, database structure, line numbers, and call stacks to remote users. This information disclosure helps attackers map the application's internal architecture and identify additional vulnerabilities to exploit.

## Quick answers

**Is CVE-2026-86308 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86308 being exploited in the wild.

**How severe is CVE-2026-86308?** Medium severity, with a CVSS score of 5.3, published 7 September 2026.

**Which products and versions are affected?** light0011 CMS commit f72cf46f601efb2a0618c3814cc2f61380b38930 and related rolling releases.

**Is there a fix for CVE-2026-86308?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86308 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86308?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an information disclosure flaw caused by enabling APP_DEBUG=True in index.php and DB_DEBUG=True in App/Common/Conf/config.php. The vulnerable component is the debug mode configuration in App/Common/Conf/config.php, specifically the DB_DEBUG parameter. The attack requires network access to the application with no authentication needed; an attacker can trigger the information disclosure by invoking endpoints that cause exceptions (such as the upload action in UserController). When exceptions occur, the application returns detailed stack traces, file paths, line numbers, and version information to remote clients instead of generic error messages. This reveals the application's internal structure, ThinkPHP framework details, and database configuration, significantly reducing the reconnaissance effort needed for follow-up attacks. No patch has been released as the project uses rolling releases and the maintainers have not responded to the issue report.

## Affected products

- light0011 CMS commit f72cf46f601efb2a0618c3814cc2f61380b38930 and related rolling releases

## Timeline

- 2026-07-18: disclosed: Issue #10 opened on GitHub
- 2026-09-07: advisory: CVE-2026-86308 published

## References

- [https://github.com/light0011/cms/](https://github.com/light0011/cms/)
- [https://github.com/light0011/cms/issues/10](https://github.com/light0011/cms/issues/10)