CVE-2026-86305: light0011 CMS Unrestricted Upload RCE Flaw

CVE-2026-86305 Overview

CVE-2026-86305 is an unrestricted file upload vulnerability affecting the light0011 CMS project. The flaw resides in the Upload::upload function within ThinkPHP/Library/Think/Upload.class.php. Attackers can manipulate the upload routine to bypass file type restrictions and write arbitrary content to the server. The issue is exploitable remotely without authentication or user interaction. A public exploit has been released, increasing the likelihood of opportunistic attacks against exposed installations. The project uses a rolling release strategy, so no fixed version identifier is available. According to VulDB, the maintainers were notified through an issue report but have not responded. The weakness is categorized under CWE-284: Improper Access Control.

Critical Impact
A remote, unauthenticated attacker can upload arbitrary files to the server, potentially leading to webshell deployment and full application compromise.

Affected Products

light0011 CMS (commit c774dce31c6df0055568a8d5c53d964d99be199d)
light0011 CMS (commit f72cf46f601efb2a0618c3814cc2f61380b38930)
ThinkPHP Upload.class.php component as bundled in the affected commits

Discovery Timeline

2026-09-07 - CVE-2026-86305 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86305

Vulnerability Analysis

The vulnerability affects the Upload::upload method in ThinkPHP/Library/Think/Upload.class.php, a file handler bundled with the light0011 CMS project. The function fails to enforce sufficient restrictions on uploaded file content, extension, or MIME type. An attacker submits a crafted multipart HTTP request to the upload endpoint and places a chosen file within the web root or a web-accessible directory. Because the check accepts attacker-controlled input, executable server-side scripts such as PHP files can be written to disk. Once written, the attacker requests the file over HTTP to trigger execution, yielding a foothold for further activity. The public availability of exploit material lowers the technical barrier to attack.

Root Cause

The root cause is improper access control on the file upload workflow [CWE-284]. The Upload::upload function does not correctly validate or constrain the type, extension, or destination of user-supplied files. Trust boundaries between the client-supplied multipart payload and the server-side write operation are not enforced.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP POST request containing a malicious file to an upload endpoint that routes through the vulnerable Upload::upload function. Successful exploitation places an attacker-controlled file into a location where it can be retrieved or executed by the web server.

No verified proof-of-concept code is included in this advisory. Consult the VulDB entry for CVE-2026-86305 and the GitHub Issue #9 Discussion for public technical details.

Detection Methods for CVE-2026-86305

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) appearing in upload or media directories.
HTTP POST requests to upload endpoints with Content-Type: multipart/form-data originating from unusual source addresses.
Web server access logs showing GET requests to newly created files inside upload directories, followed by outbound network connections.
New or modified files under the CMS document root with server-process ownership and recent timestamps.

Detection Strategies

Inspect web server and application logs for POST traffic to routes handled by Upload::upload and correlate with subsequent GET requests to the same file paths.
Deploy web application firewall rules to flag multipart uploads containing PHP tags (<?php, <?=) or shell function names.
Perform integrity monitoring on upload directories to detect creation of scripts in locations that should only contain static assets.

Monitoring Recommendations

Alert on any file creation with executable script extensions inside directories writable by the web server.
Monitor process trees for web server processes spawning shells (sh, bash, cmd.exe) or interpreter processes with network activity.
Track outbound connections from the web application host to unknown external endpoints following upload activity.

How to Mitigate CVE-2026-86305

Immediate Actions Required

Restrict network access to the light0011 CMS administrative and upload endpoints until a fix is available.
Audit upload directories for unauthorized files and remove any suspicious scripts.
Configure the web server to deny script execution within upload directories.
Review authentication and session controls on any endpoint that reaches Upload::upload.

Patch Information

No vendor patch is currently available. The project maintainers were notified through the GitHub Issue #9 Discussion but have not published a fix. Because the project follows a rolling release model, monitor the light0011 CMS repository for updates to ThinkPHP/Library/Think/Upload.class.php that add allow-list validation, extension enforcement, and safe destination handling.

Workarounds

Enforce a server-side allow-list of permitted MIME types and extensions before writing uploaded files to disk.
Store uploaded files outside the web root or in a location where the web server is configured to serve them as static content only.
Rename uploaded files to server-generated identifiers and strip original extensions to prevent execution based on user-supplied names.
Place a reverse proxy or web application firewall in front of the CMS to filter malicious multipart payloads.

bash

# Example: deny PHP execution in the uploads directory (Apache .htaccess)
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7)$">
    Require all denied
</FilesMatch>

# Example: nginx equivalent inside the uploads location block
location ^~ /uploads/ {
    location ~ \.(php|phtml|phar)$ {
        deny all;
        return 403;
    }
}