CVE-2026-91849: WuzhiCMS File Upload RCE Vulnerability

CVE-2026-91849 Overview

CVE-2026-91849 is an unrestricted file upload vulnerability in WuzhiCMS versions up to 4.1.0. The flaw resides in the member::setAvatar function, reachable via /index.php?m=member&f=user&v=setAvatar in the Avatar Upload component. Attackers with low-privilege accounts can manipulate the File parameter to upload arbitrary files over the network. A public exploit has been released, and the maintainers have not yet responded to the issue report filed against the project. The weakness is classified under [CWE-284: Improper Access Control].

Critical Impact
Authenticated remote attackers can upload arbitrary files through the avatar endpoint, potentially leading to malicious content hosting or web shell deployment on affected WuzhiCMS installations.

Affected Products

WuzhiCMS versions up to and including 4.1.0
Avatar Upload component (member::setAvatar)
Endpoint /index.php?m=member&f=user&v=setAvatar

Discovery Timeline

2026-09-15 - CVE-2026-91849 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91849

Vulnerability Analysis

The vulnerability affects the avatar upload workflow exposed through the member module of WuzhiCMS. When a user submits a file to /index.php?m=member&f=user&v=setAvatar, the member::setAvatar handler processes the File argument without adequately restricting the file type, extension, or content. This permits an authenticated attacker to upload files that fall outside the intended image formats.

Because the attack is delivered over the network and requires only low privileges, any user able to register or log in to a vulnerable WuzhiCMS site can attempt exploitation. According to VulDB, working exploit code has been released publicly, increasing the likelihood of opportunistic abuse.

The EPSS probability sits at 0.272% with a percentile of 19.615, indicating moderate but non-trivial expected exploitation activity relative to peer vulnerabilities.

Root Cause

The root cause is improper access control on file uploads [CWE-284]. The setAvatar handler does not enforce a strict allowlist of file types or validate uploaded content against expected image formats. This allows the File argument to accept arbitrary payloads that the application then writes to disk.

Attack Vector

An attacker authenticates to a WuzhiCMS instance with a low-privilege member account. The attacker then issues a crafted multipart POST request to the avatar upload endpoint, substituting the expected image with an arbitrary file payload. Successful uploads may be reachable through the web root, depending on the destination directory configuration.

No verified proof-of-concept code has been published in the references provided. See GitHub WuzhiCMS Issue #219 and VulDB CVE-2026-91849 for further technical context.

Detection Methods for CVE-2026-91849

Indicators of Compromise

Unexpected files present within the WuzhiCMS avatar upload directory, especially with executable extensions such as .php, .phtml, or .phar.
Web server access logs showing POST requests to /index.php?m=member&f=user&v=setAvatar from newly registered or low-reputation accounts.
Follow-up GET requests to uploaded files under the avatar storage path shortly after an upload event.

Detection Strategies

Inspect HTTP request bodies for multipart uploads to the setAvatar endpoint carrying MIME types or file extensions inconsistent with images.
Correlate member account creation events with subsequent avatar upload requests to surface newly created accounts abusing the endpoint.
Monitor filesystem writes under WuzhiCMS upload directories for files whose magic bytes do not match declared image formats.

Monitoring Recommendations

Enable web application firewall rules that block uploads containing server-side script extensions to the setAvatar endpoint.
Forward WuzhiCMS web server and PHP-FPM logs to a centralized SIEM for correlation and retention.
Alert on execution of PHP interpreters serving files from upload directories, which typically should serve only static media.

How to Mitigate CVE-2026-91849

Immediate Actions Required

Restrict access to /index.php?m=member&f=user&v=setAvatar at the reverse proxy or WAF layer until a patched version is available.
Disable PHP execution within upload directories using web server configuration to prevent uploaded files from being executed.
Audit existing avatar upload directories for suspicious files and remove any non-image content.

Patch Information

At the time of publication, the WuzhiCMS project has not responded to the issue report and no official patch has been released. Track the upstream repository at GitHub WuzhiCMS Repository and the associated GitHub WuzhiCMS Issue #219 for updates.

Workarounds

Enforce server-side validation that verifies uploaded avatars are valid image files by inspecting file headers and using image processing libraries to re-encode uploads.
Configure the web server to deny execution of scripts within the avatar storage path (for example, with an Apache <Directory> block or Nginx location rule).
Require additional verification or CAPTCHA for account registration to reduce the pool of low-privilege attacker accounts.

bash

# Nginx configuration example: disable script execution in upload directory
location ^~ /uploads/ {
    location ~ \.(php|phtml|phar)$ {
        deny all;
        return 403;
    }
}