CVE-2026-86666: iWebShop-5 Unrestricted Upload RCE Vulnerability

CVE-2026-86666 Overview

CVE-2026-86666 is an unrestricted file upload vulnerability in aircheng-org iWebShop-5 versions up to 5.15. The flaw resides in the upload_json/uploadFile function within the controllers/pic.php file. Attackers can exploit the weakness remotely without authentication or user interaction. The vulnerability is categorized under [CWE-284: Improper Access Control].

A public exploit has been released, increasing the likelihood of opportunistic attacks against exposed iWebShop-5 deployments. The project maintainers were notified through an issue report but have not responded at the time of publication, meaning no official patch is available.

Critical Impact

Remote attackers can upload arbitrary files to affected iWebShop-5 instances, potentially leading to webshell placement and follow-on code execution on the hosting server.

Affected Products

• aircheng-org iWebShop-5 versions up to and including 5.15
• The vulnerable component is controllers/pic.php
• The vulnerable function is upload_json/uploadFile

Discovery Timeline

• 2026-09-08 - CVE-2026-86666 published to NVD
• 2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86666

Vulnerability Analysis

The vulnerability exists in the uploadFile handler exposed through the upload_json route in controllers/pic.php. The handler accepts uploaded files without enforcing sufficient restrictions on file type, extension, or content. An unauthenticated remote attacker can submit crafted HTTP requests to place arbitrary files on the server.

iWebShop-5 is a PHP-based e-commerce platform. When file upload endpoints in PHP applications lack validation, attackers commonly upload scripts with executable extensions such as .php or .phtml. If the upload directory is web-accessible and PHP execution is not blocked, the uploaded file can be requested directly and executed by the web server.

The EPSS score at publication is 0.5%, reflecting low observed exploitation activity to date. However, the availability of a public exploit and the lack of vendor response elevate the practical risk.

Root Cause

The root cause is improper access control combined with missing validation on the upload handler. The uploadFile function does not verify the caller's authorization or restrict the accepted file types. This design allows any network-reachable attacker to invoke the endpoint and store arbitrary content on disk.

Attack Vector

The attack vector is network-based. An attacker sends an HTTP POST request to the upload_json/uploadFile endpoint with a malicious file payload. No credentials, tokens, or user interaction are required. Successful exploitation results in the file being written to a location on the server, which may be reachable from the web root. Refer to the VulDB CVE-2026-86666 Details and the GitHub iWebShop-5 Issue #3 for additional technical context.

Detection Methods for CVE-2026-86666

Indicators of Compromise

• Unexpected files with executable extensions such as .php, .phtml, or .phar inside iWebShop-5 upload directories.
• HTTP POST requests to routes containing upload_json/uploadFile from external or untrusted source IP addresses.
• New or modified files under the iWebShop-5 web root with recent timestamps that do not correspond to legitimate administrative activity.

Detection Strategies

• Monitor web server access logs for requests targeting controllers/pic.php or the upload_json/uploadFile route.
• Deploy web application firewall rules that inspect multipart upload payloads and reject files whose declared MIME type or extension is executable.
• Perform periodic filesystem integrity checks against the iWebShop-5 installation to identify unauthorized additions.

Monitoring Recommendations

• Alert on process creation events where the web server user spawns shells, curl, wget, or interpreters shortly after upload activity.
• Track outbound network connections initiated by the PHP process, which often indicate webshell command-and-control traffic.
• Log and review all authentication and administrative actions performed near suspicious upload events for correlation.

How to Mitigate CVE-2026-86666

Immediate Actions Required

• Restrict network access to iWebShop-5 administrative and upload endpoints using firewall rules or reverse proxy allowlists.
• Disable PHP execution within upload directories at the web server level to prevent uploaded scripts from running.
• Audit existing upload directories for unauthorized files and remove any that cannot be attributed to legitimate activity.

Patch Information

No official patch is available at the time of publication. According to the VulDB Vulnerability #399757 entry, the project was informed through the GitHub iWebShop-5 Issue #3 but has not responded. Administrators should track the GitHub iWebShop-5 Repository for future updates and apply any released fixes promptly.

Workarounds

• Configure the web server to deny execution of PHP and other scripts within upload paths using directives such as Apache php_flag engine off or nginx location blocks that return static content only.
• Place iWebShop-5 behind a web application firewall configured to block file uploads with executable extensions and to enforce strict content-type checks.
• Where feasible, take affected iWebShop-5 instances offline until a vendor patch is released and validated.

# Example nginx configuration to block script execution in upload directories
location ~* ^/upload/.*\.(php|phtml|phar|php5|pl|py|jsp|asp|sh|cgi)$ {
    deny all;
    return 403;
}