CVE-2026-88419: WuzhiCMS 5.0.0 File Upload RCE Vulnerability

CVE-2026-88419 Overview

CVE-2026-88419 is an unrestricted file upload vulnerability in WuzhiCMS 5.0.0. The flaw resides in the thumbnail-upload endpoint at /index.php?m=member&f=article&v=thumbUpload. An authenticated low-privileged member account can upload a crafted .php file and achieve arbitrary PHP code execution on the server. The application accepts the file extension verbatim from the client-supplied filename and writes the file to the web-accessible uploadfile/ directory, where the web server executes PHP. The weakness maps to [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact

Authenticated attackers with member-level privileges gain remote code execution as the web server user, enabling full compromise of the WuzhiCMS host.

Affected Products

• WuzhiCMS 5.0.0
• Deployments exposing the member article thumbnail-upload endpoint
• Installations serving the uploadfile/ directory through a PHP-enabled web server

Discovery Timeline

• 2026-09-22 - CVE-2026-88419 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-88419

Vulnerability Analysis

The thumbnail-upload handler exposed at /index.php?m=member&f=article&v=thumbUpload processes multipart file uploads submitted by authenticated members. The handler trusts the filename supplied by the client and reuses its extension when writing the file to disk. No allowlist restricts extensions to image formats such as .jpg, .png, or .gif, and no MIME or magic-byte inspection validates that the payload is an image.

Because uploaded content lands in the uploadfile/ directory served directly by the web server, any file with a .php extension is executed by the PHP interpreter when requested. An attacker who registers a standard member account can upload a webshell and invoke it over HTTP. The result is arbitrary command execution in the context of the web server process.

Root Cause

The root cause is missing server-side validation of both file extension and file content. The upload routine preserves the attacker-controlled extension verbatim and does not enforce a deny-list, allowlist, or content sniffing step. Compounding this, the destination directory is web-reachable and configured to execute PHP scripts.

Attack Vector

Exploitation requires network access to the WuzhiCMS instance and a valid member account. The attacker submits a POST request to the thumbnail-upload endpoint carrying a PHP payload with a .php filename. After the server writes the file to uploadfile/, the attacker requests the uploaded URL to trigger execution. No user interaction is required from an administrator. See the GitHub CVE Issue for reproduction details.

Detection Methods for CVE-2026-88419

Indicators of Compromise

• Files with executable extensions such as .php, .phtml, or .phar present in the uploadfile/ directory of a WuzhiCMS deployment.
• HTTP POST requests to /index.php?m=member&f=article&v=thumbUpload from member accounts uploading non-image content.
• Subsequent HTTP GET requests to newly created files under uploadfile/ followed by outbound connections or shell command spawns from the web server process.

Detection Strategies

• Inspect web server access logs for POST requests to the thumbUpload action followed by GET requests to newly written files in uploadfile/.
• Monitor the uploadfile/ directory for the creation of files whose extensions do not match expected image types.
• Alert on child processes of the PHP or web server process that spawn shells, interpreters, or reconnaissance utilities.

Monitoring Recommendations

• Enable file integrity monitoring on the WuzhiCMS uploadfile/ directory and web root.
• Forward web server, PHP-FPM, and process telemetry into a centralized data lake for correlation of upload and execution events.
• Track authentication events for member accounts that immediately perform uploads followed by requests to uploaded assets.

How to Mitigate CVE-2026-88419

Immediate Actions Required

• Restrict access to the member registration and article thumbnail-upload endpoints until a patched build is deployed.
• Reconfigure the web server to disable PHP execution within the uploadfile/ directory.
• Audit the uploadfile/ directory for existing webshells and rotate any credentials stored on the host.

Patch Information

No vendor patch has been published in the referenced advisory at the time of NVD publication. Track the GitHub CVE Issue and the WuzhiCMS project for updates, and apply fixed releases as soon as they are available.

Workarounds

• Enforce an allowlist of image extensions (.jpg, .jpeg, .png, .gif) and validate content using magic-byte inspection before writing files to disk.
• Rename uploaded files to server-generated names and strip any client-supplied extension.
• Deny PHP handler execution in upload directories through web server configuration, for example using an Apache <Directory> block or an Nginx location rule.

# Nginx: disable PHP execution in the WuzhiCMS uploadfile directory
location ^~ /uploadfile/ {
    location ~* \.(php|phtml|phar)$ {
        deny all;
        return 403;
    }
}