Executive brief
WuzhiCMS is a PHP-based content management system used to build websites. The thumbnail upload feature fails to validate file types, allowing authenticated members to upload PHP files that execute arbitrary code on the server. An attacker can gain complete control of the affected web server by uploading a malicious PHP file and accessing it through the web browser.
Technical details
The vulnerability is an unrestricted file upload (CWE-434) in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) that takes the file extension directly from the client-supplied filename without validation and stores it in a web-accessible directory where PHP execution is enabled. An authenticated low-privileged member can upload a .php file containing arbitrary PHP code; when the returned URL is accessed, the web server executes the code in the context of the web process. The same vulnerability pattern exists in the avatar-upload handler.
Affected products
- WuzhiCMS WuzhiCMS 5.0.0
Timeline
- 2026-09-22: disclosed