Executive brief
WuzhiCMS is a PHP-based content management system used to manage website content. The avatar upload function fails to validate file types, allowing authenticated users to upload and execute arbitrary code (such as web shells) on the server, leading to complete compromise of the website and potential access to sensitive data.
Technical details
The vulnerability exists in the member::setAvatar() function in /index.php?m=member&f=user&v=setAvatar, which accepts file uploads without proper validation. The code derives file extensions solely from the untrusted client-supplied filename using strtolower(pathinfo()) with no whitelist, MIME-type check, or image content validation. The uploaded file is written directly into the web-accessible uploadfile/member/<uid>/ directory where PHP execution is enabled. An attacker with a low-privilege member account (or via self-registration, which is enabled by default) can upload a .php web shell and trigger arbitrary code execution by requesting the predictable URL. The vulnerability requires an authenticated session but allows full remote code execution at web server privileges.
Affected products
- WuzhiCMS WuzhiCMS up to 4.1.0
Timeline
- 2026-07-10: disclosed: Issue reported on GitHub
- 2026-09-15: advisory: CVE-2026-91849 published