CVE-2026-35047: Brave CMS File Upload RCE Vulnerability

CVE-2026-35047 Overview

CVE-2026-35047 is a critical Unrestricted File Upload vulnerability affecting Brave CMS, an open-source content management system. Prior to version 2.0.6, the CKEditor endpoint fails to properly validate uploaded files, allowing attackers to upload arbitrary files including executable scripts. This vulnerability can lead to Remote Code Execution (RCE) on the server, potentially resulting in full system compromise, data exfiltration, or service disruption.

Critical Impact

Attackers can upload malicious executable scripts through the CKEditor endpoint, enabling Remote Code Execution and potentially full server compromise.

Affected Products

• Brave CMS versions prior to 2.0.6
• BraveCMS-2.0 installations using the vulnerable CKEditor endpoint
• All users running affected versions of BraveCMS

Discovery Timeline

• 2026-04-06 - CVE-2026-35047 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35047

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The CKEditor endpoint in Brave CMS lacks proper file type validation, allowing attackers to bypass intended upload restrictions. Without adequate server-side validation, malicious actors can upload executable scripts (such as PHP web shells) that can then be accessed directly on the server to execute arbitrary commands.

The vulnerability is network-accessible and requires no authentication or user interaction to exploit, making it particularly dangerous for internet-facing Brave CMS installations.

Root Cause

The root cause of this vulnerability lies in insufficient file upload validation within the CKEditor controller. The original implementation did not adequately restrict the types of files that could be uploaded through the editor's file upload functionality. The patch adds proper MIME type validation to restrict uploads to safe image formats (jpg, jpeg, png, webp).

Attack Vector

The attack vector is network-based and exploits the file upload functionality in the CKEditor endpoint. An attacker can craft a malicious HTTP request to upload an executable script file disguised with an allowed extension or exploit missing validation logic. Once uploaded, the attacker can access the malicious file directly via its URL to trigger code execution on the server.

The following patch demonstrates the security fix applied in ArticleController.php:

     'category_id' => 'required|exists:article_categories,id',
     'title' => 'required|string|max:190',
     'short_description' => 'required|string|max:190',
-    'image' => 'image|mimes:jpeg,jpg,png|max:2048',
+    'image' => 'image|mimes:jpg,jpeg,png,webp|max:2048',
     'video' => 'file|mimes:mp4,mov|max:20480',
     'content' => 'required|string',
     'published_at' => 'nullable|date',

Source: GitHub Commit Update

Detection Methods for CVE-2026-35047

Indicators of Compromise

• Unexpected files with executable extensions (.php, .phtml, .asp, .aspx, .jsp) in upload directories
• Web shell files or suspicious scripts in CKEditor upload folders
• Unusual outbound network connections from the web server
• Abnormal process execution by the web server user account

Detection Strategies

• Monitor file upload events to CKEditor endpoints for non-image file types
• Implement web application firewall (WAF) rules to detect file upload bypass attempts
• Review web server access logs for requests to uploaded files with executable extensions
• Use file integrity monitoring on upload directories to detect new executable files

Monitoring Recommendations

• Enable detailed logging for all file upload operations in Brave CMS
• Configure alerts for uploads of files with potentially dangerous MIME types
• Monitor web server processes for unexpected child process spawning
• Implement regular security scans of upload directories for malicious content

How to Mitigate CVE-2026-35047

Immediate Actions Required

• Upgrade Brave CMS to version 2.0.6 or later immediately
• Review upload directories for any suspicious or unexpected files
• Audit web server logs for signs of exploitation attempts
• Consider temporarily disabling the CKEditor file upload functionality until patched

Patch Information

The vulnerability has been fixed in Brave CMS version 2.0.6. The security patch implements proper file type validation in the CKEditor controller to prevent upload of arbitrary file types. Users should update immediately by applying the fix from GitHub Pull Request #122. Additional details are available in the GitHub Security Advisory GHSA-9rcc-w59j-965v.

Workarounds

• Restrict access to CKEditor upload endpoints via web server configuration until the patch can be applied
• Implement server-level file upload validation using .htaccess or web server rules to block executable extensions
• Use a Web Application Firewall (WAF) to filter requests containing dangerous file types
• Configure upload directories to be non-executable at the web server level

# Apache configuration to prevent script execution in upload directories
<Directory "/var/www/html/uploads">
    php_admin_flag engine off
    Options -ExecCGI
    RemoveHandler .php .phtml .php3 .php4 .php5 .phps
    AddType text/plain .php .phtml .php3 .php4 .php5 .phps
</Directory>