Is CVE-2026-91849 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91849 being exploited in the wild.

How severe is CVE-2026-91849?

Medium severity, with a CVSS score of 6.3, published 15 September 2026.

Is there a fix for CVE-2026-91849?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-91849 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-91849?

Check whether you run WuzhiCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91849: WuzhiCMS arbitrary file upload via avatar function

CVE-2026-91849 · Severity: medium · CVSS 6.3 · Published 2026-09-15

WuzhiCMS is a PHP-based content management system used to manage website content. The avatar upload function fails to validate file types, allowing authenticated users to upload and execute arbitrary code (such as web shells) on the server, leading to complete compromise of the website and potential access to sensitive data.

Technologies: WuzhiCMS. Vendors: WuzhiCMS.

Quick answers

Is CVE-2026-91849 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91849 being exploited in the wild.
How severe is CVE-2026-91849?: Medium severity, with a CVSS score of 6.3, published 15 September 2026.
Which products and versions are affected?: WuzhiCMS up to 4.1.0.
Is there a fix for CVE-2026-91849?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-91849 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-91849?: Check whether you run WuzhiCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the member::setAvatar() function in /index.php?m=member&f=user&v=setAvatar, which accepts file uploads without proper validation. The code derives file extensions solely from the untrusted client-supplied filename using strtolower(pathinfo()) with no whitelist, MIME-type check, or image content validation. The uploaded file is written directly into the web-accessible uploadfile/member/<uid>/ directory where PHP execution is enabled. An attacker with a low-privilege member account (or via self-registration, which is enabled by default) can upload a .php web shell and trigger arbitrary code execution by requesting the predictable URL. The vulnerability requires an authenticated session but allows full remote code execution at web server privileges.

Affected products

WuzhiCMS WuzhiCMS up to 4.1.0

Timeline

2026-07-10: disclosed: Issue reported on GitHub
2026-09-15: advisory: CVE-2026-91849 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.