CVE-2026-15530 Overview
CVE-2026-15530 is an information disclosure vulnerability affecting WuzhiCMS versions up to 4.1.0. The flaw resides in the config/listimage function within /index.php?m=attachment&f=index&v=upload, part of the Attachment API component. Remote attackers can manipulate this endpoint to disclose sensitive information without authentication or user interaction. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. A public exploit has been released, and the WuzhiCMS project has not responded to the early issue report at time of disclosure.
Critical Impact
Unauthenticated remote attackers can retrieve sensitive attachment data through the WuzhiCMS Attachment API, exposing information that may support further intrusion.
Affected Products
- WuzhiCMS versions up to and including 4.1.0
- Attachment API component (/index.php?m=attachment&f=index&v=upload)
- Deployments exposing the config/listimage function to untrusted networks
Discovery Timeline
- 2026-07-13 - CVE-2026-15530 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-15530
Vulnerability Analysis
The vulnerability affects the Attachment API in WuzhiCMS, a content management system written in PHP. The config/listimage function within /index.php?m=attachment&f=index&v=upload returns attachment or image listing data without enforcing appropriate authorization checks. An attacker can reach this endpoint over the network and receive information that should remain restricted to authenticated administrators.
According to VulDB, an exploit has been made public and may already be used against exposed installations. The vendor has not acknowledged the GitHub issue #217 filed against the project, so no official patch exists at time of publication.
Root Cause
The root cause is missing or insufficient access control on the config/listimage handler in the Attachment API. The endpoint discloses stored attachment metadata to callers that lack an authenticated session. This aligns with [CWE-200], where sensitive data is exposed to unauthorized actors through an application interface.
Attack Vector
Exploitation requires only network access to the vulnerable WuzhiCMS instance. The attacker issues a crafted HTTP request to /index.php?m=attachment&f=index&v=upload invoking the config/listimage action. No credentials, privileges, or user interaction are required. The response returns attachment listing data, which attackers can harvest to enumerate uploaded content, filenames, or paths useful for chaining into further attacks.
See the VulDB entry for CVE-2026-15530 and the WuzhiCMS GitHub repository for additional technical context.
Detection Methods for CVE-2026-15530
Indicators of Compromise
- HTTP requests to /index.php?m=attachment&f=index&v=upload invoking the listimage action from unauthenticated or unexpected source IPs
- Unusual volumes of GET or POST requests targeting the Attachment API endpoint
- Web server access logs showing enumeration patterns against attachment listing parameters
Detection Strategies
- Inspect web server and PHP access logs for repeated calls to the attachment module with the upload view and listimage configuration
- Deploy web application firewall (WAF) rules that flag unauthenticated access to the WuzhiCMS Attachment API
- Correlate outbound data volume anomalies from the WuzhiCMS host with corresponding inbound requests to the vulnerable endpoint
Monitoring Recommendations
- Alert on any HTTP 200 responses to listimage requests originating from sessions without a valid authentication cookie
- Baseline normal administrator access patterns to the Attachment API and flag deviations
- Retain full HTTP request and response metadata for the WuzhiCMS application to support incident review
How to Mitigate CVE-2026-15530
Immediate Actions Required
- Restrict network exposure of WuzhiCMS administrative endpoints to trusted IP ranges or VPN access only
- Place the WuzhiCMS instance behind a WAF and block unauthenticated requests to /index.php?m=attachment&f=index&v=upload
- Audit existing web logs for prior access to the config/listimage function and assess what data may have been exposed
Patch Information
No official patch has been released. The maintainers have not responded to GitHub issue #217. Monitor the WuzhiCMS GitHub repository for updates and apply any vendor fix as soon as it becomes available. Until then, treat all instances up to version 4.1.0 as vulnerable.
Workarounds
- Enforce authentication in front of the Attachment API through reverse proxy access controls
- Disable or remove the Attachment API endpoint if the listimage functionality is not required for production use
- Consider migrating to an alternative, actively maintained CMS if the vendor remains unresponsive to security reports
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
