# CVE-2026-86666: aircheng-org iWebShop-5 unrestricted file upload in pic controller

Source: https://junglewise.ai/threats/cve-2026-86666-aircheng-org-iwebshop-5-unrestricted-file-upload-in-pic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86666 · Severity: high · CVSS 7.3 · Published 2026-09-08

iWebShop-5 is an e-commerce platform built on PHP and MySQL that powers online marketplaces. An attacker can upload arbitrary files—including executable code—to the server without authentication through exposed image upload endpoints. This allows an attacker to store malicious files on the server and potentially execute code, enabling account takeover, data theft, or complete system compromise.

Technologies: [Aircheng-Org iWebShop-5](https://junglewise.ai/threats/technologies/iwebshop-5). Vendors: [Aircheng-Org](https://junglewise.ai/threats/vendors/aircheng-org).

## Quick answers

**Is CVE-2026-86666 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86666 being exploited in the wild.

**How severe is CVE-2026-86666?** High severity, with a CVSS score of 7.3, published 8 September 2026.

**Which products and versions are affected?** Aircheng-Org iWebShop-5 up to 5.15.

**Is there a fix for CVE-2026-86666?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86666 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86666?** Check whether you run Aircheng-Org iWebShop-5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unrestricted file upload (CWE-434) affecting the upload_json and uploadFile functions in controllers/pic.php. The pic controller is publicly accessible and lacks authentication checks. The underlying upload class permits non-image file types (ZIP, SWF, etc.) and uses a broken hex-scanning pattern in filter_class.php that fails to detect PHP short tags (<?=) and null bytes. An unauthenticated remote attacker can upload malicious files by sending a POST request to /index.php?controller=pic&action=upload_json or uploadFile. Uploaded files are stored in a web-accessible directory (/upload/detail/) allowing direct execution or inclusion. Combined with web server configuration or local file inclusion flaws, this enables remote code execution.

## Affected products

- aircheng-org iWebShop-5 up to 5.15

## Timeline

- 2026-07-29: disclosed: Issue reported on GitHub
- 2026-09-08: advisory: CVE-2026-86666 published

## References

- [https://github.com/aircheng-org/iWebShop-5/](https://github.com/aircheng-org/iWebShop-5/)
- [https://github.com/aircheng-org/iWebShop-5/issues/3](https://github.com/aircheng-org/iWebShop-5/issues/3)

## Related threats

- [aircheng-org iWebShop-5 weak password recovery in send_message_mobile](https://junglewise.ai/threats/cve-2026-112035-a-security-vulnerability-has-been-detected-in-aircheng-org)
- [iWebShop-5 open redirect in login callback parameter](https://junglewise.ai/threats/cve-2026-112034-a-weakness-has-been-identified-in-aircheng-org-iwebshop-5-up-to)
- [aircheng-org iWebShop-5 CSRF in admin password change](https://junglewise.ai/threats/cve-2026-112033-a-security-flaw-has-been-discovered-in-aircheng-org-iwebshop-5)
- [aircheng-org iWebShop-5 weak password hashing](https://junglewise.ai/threats/cve-2026-86670-aircheng-org-iwebshop-5-weak-password-hashing)
- [aircheng-org iWebShop-5 authentication bypass in seller login](https://junglewise.ai/threats/cve-2026-86669-aircheng-org-iwebshop-5-authentication-bypass-in-seller-login)