Is CVE-2026-86668 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86668 being exploited in the wild.

How severe is CVE-2026-86668?

Medium severity, with a CVSS score of 4.3, published 8 September 2026.

Which products and versions are affected?

Aircheng-Org iWebShop-5 up to 5.15.

Is there a fix for CVE-2026-86668?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86668 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86668?

Check whether you run Aircheng-Org iWebShop-5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86668: aircheng-org iWebShop-5 cross-site scripting in pic.php

CVE-2026-86668 · Severity: medium · CVSS 4.3 · Published 2026-09-08

iWebShop-5 is an e-commerce platform used to run online marketplaces. An unauthenticated attacker can inject malicious JavaScript code through the file upload feature, which runs in the context of the shop's origin. This allows theft of administrative cookies and takeover of the e-commerce platform without any user interaction beyond visiting a crafted link.

Technologies: Aircheng-Org iWebShop-5. Vendors: Aircheng-Org.

Quick answers

Is CVE-2026-86668 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86668 being exploited in the wild.
How severe is CVE-2026-86668?: Medium severity, with a CVSS score of 4.3, published 8 September 2026.
Which products and versions are affected?: Aircheng-Org iWebShop-5 up to 5.15.
Is there a fix for CVE-2026-86668?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86668 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86668?: Check whether you run Aircheng-Org iWebShop-5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in the uploadFile function within controllers/pic.php. The vulnerable code accepts user-supplied input via the outerSrc or selectPhoto POST parameters and reflects them directly into an inline JavaScript snippet without encoding or sanitization. The endpoint requires no authentication. An attacker can inject JavaScript code that breaks out of the string context and executes arbitrary code in the browser, including stealing session cookies. The reported CVSS v3.1 score is 6.1 (Medium). The project has not yet responded to the disclosure, and no patch is currently available.

Affected products

aircheng-org iWebShop-5 up to 5.15

Timeline

2026-07-29: disclosed: Vulnerability reported on GitHub issue #4
2026-09-08: advisory: CVE-2026-86668 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.