# CVE-2026-88419: WuzhiCMS unrestricted file upload in thumbnail endpoint

Source: https://junglewise.ai/threats/cve-2026-88419-an-unrestricted-upload-of-files-with-a-dangerous-type-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88419 · Severity: high · CVSS 8.8 · Published 2026-09-22

WuzhiCMS is a PHP-based content management system used to build websites. The thumbnail upload feature fails to validate file types, allowing authenticated members to upload PHP files that execute arbitrary code on the server. An attacker can gain complete control of the affected web server by uploading a malicious PHP file and accessing it through the web browser.

Technologies: [WuzhiCMS](https://junglewise.ai/threats/technologies/wuzhicms). Vendors: [WuzhiCMS](https://junglewise.ai/threats/vendors/wuzhicms).

## Quick answers

**Is CVE-2026-88419 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88419 being exploited in the wild.

**How severe is CVE-2026-88419?** High severity, with a CVSS score of 8.8, published 22 September 2026.

**Which products and versions are affected?** WuzhiCMS 5.0.0.

**Is there a fix for CVE-2026-88419?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88419 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-88419?** Check whether you run WuzhiCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unrestricted file upload (CWE-434) in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) that takes the file extension directly from the client-supplied filename without validation and stores it in a web-accessible directory where PHP execution is enabled. An authenticated low-privileged member can upload a .php file containing arbitrary PHP code; when the returned URL is accessed, the web server executes the code in the context of the web process. The same vulnerability pattern exists in the avatar-upload handler.

## Affected products

- WuzhiCMS WuzhiCMS 5.0.0

## Timeline

- 2026-09-22: disclosed

## References

- [https://github.com/15536818056/CVE/issues/6](https://github.com/15536818056/CVE/issues/6)

## Related threats

- [WuzhiCMS open redirect in member login](https://junglewise.ai/threats/cve-2026-94102-a-flaw-has-been-found-in-wuzhicms-up-to-4-1-0-this-affects-an)
- [WuzhiCMS remote image fetch server-side request forgery](https://junglewise.ai/threats/cve-2026-92380-wuzhicms-remote-image-fetch-server-side-request-forgery)
- [WuzhiCMS arbitrary file upload via avatar function](https://junglewise.ai/threats/cve-2026-91849-wuzhicms-arbitrary-file-upload-via-avatar-function)
- [WuzhiCMS SQL injection in article::getDataOfJson](https://junglewise.ai/threats/cve-2026-91848-wuzhicms-sql-injection-in-article-getdataofjson)
- [WuzhiCMS Attachment API information disclosure](https://junglewise.ai/threats/cve-2026-15530-wuzhicms-attachment-api-information-disclosure)