CVE-2026-105123: W wcms File Write & RCE
TL;DR - CVE-2026-105123 affects W (vincent-peugnet/wcms) through version 3.18.0. - Authenticated editors can potentially upload PHP, traverse paths, write files, and delete arbitrary files. - No confirmed exploitation in the wild or fixed version is reported; apply compensating controls immediately.
Vulnerability at a Glance
| Field | Details |
|---|---|
| CVE ID | CVE-2026-105123 |
| Product | W, also identified as vincent-peugnet/wcms |
| Affected versions | All versions through and including 3.18.0 |
| CVSS score | 8.8 |
| Attack vector | Network-facing HTTP API |
| Authentication required | Yes, an authenticated editor account |
| Patch available | No confirmed fixed version identified |
| Primary impact | Arbitrary file write, arbitrary file deletion, path traversal, and potential remote code execution |
| CISA KEV status | Not listed, on_kev: false |
CVE-2026-105123 is a high-severity file-management vulnerability in W/wcms. The affected media API accepts a user-controlled path without adequately constraining it to the intended media directory. An authenticated editor may be able to use that path to place files outside the normal upload location or remove files from unintended filesystem locations.
Analyst’s Take: Treat this first as an access-control and filesystem-boundary issue, not only as an upload-filtering problem. Blocking PHP execution reduces the route to remote code execution, but it does not address arbitrary file writes and deletions.
The practical risk is highest when the application can write into a web-accessible directory and the web server passes uploaded .php files to a PHP interpreter. In that configuration, an attacker may upload a PHP payload and invoke it remotely. The issue can also damage availability or integrity where PHP execution is disabled, because arbitrary file deletion and writes may still be possible.
What Is This Vulnerability?
The vulnerable functionality is exposed through the media API, specifically:
POST /api/v0/media/upload/[*:path]DELETE /api/v0/media/[*:path]
The upload endpoint reportedly uses a path supplied by the authenticated client. The application does not sufficiently validate, normalize, and constrain that path before performing filesystem operations. Encoded parent-directory traversal sequences, including encoded forms of ../, can allow the requested location to escape the intended media directory.
This is a path traversal and arbitrary file operation flaw, not only a file-extension validation issue. Blocking one extension, such as .php, would not address the arbitrary write and delete behavior. The cited implementation locations are Controllerapimedia.php, lines 24–44, and Media.php, line 98. Defenders should treat the application’s file-path handling as untrusted until a vendor fix demonstrates canonical path validation and safe file-operation boundaries.
If PHP execution is enabled for the destination directory, the arbitrary upload capability can become remote code execution. The available record does not establish that every deployment is exploitable for code execution. The outcome depends on web-server routing, filesystem permissions, upload reachability, PHP handler configuration, and the privileges assigned to the application process.
Who Is Affected?
The affected product is W, maintained in the vincent-peugnet/wcms repository. The reported affected range is all versions through and including 3.18.0. No additional product names, supported branches, or unaffected version ranges were identified in the supplied vulnerability data.
Prioritize installations that expose the W/wcms administration interface to the internet, permit multiple editor accounts, or run the application with write access to web-server document roots. Sites using a reverse proxy or access-control layer are not automatically safe: an attacker who obtains an editor credential, abuses a trusted network path, or reaches the API through an internal service may still be able to exploit the flaw.
The vulnerability requires an authenticated editor according to the available description. Review whether editor accounts are shared, dormant, protected by multifactor authentication, or granted to third-party users. Determine whether the application process can write to configuration files, scheduled-task directories, web roots, or other sensitive paths. Those environmental details determine whether exploitation is limited to content manipulation or can produce persistent code execution.
For stronger phishing-resistant authentication, organizations can review the basics of WebAuthn and passkeys. If editor credentials may have been exposed, a password manager such as 1Password can help teams generate and manage unique credentials, although credential hygiene does not replace least-privilege access controls.
CVSS Score Breakdown
The NVD record currently reports a CVSS base score of 8.8. The retrieved record did not include the CVSS vector string, so a definitive component-by-component reconstruction should not be presented as fact. The exact values for attack complexity, privileges required, user interaction, scope, confidentiality, integrity, and availability are not available in the supplied data.
Operationally, the score is consistent with a network-reachable application endpoint that can be abused by a user with editor privileges to affect filesystem contents. The likely security consequences include unauthorized code or content placement, deletion of files, and potential execution of attacker-controlled PHP. Defenders should use the published score as the authoritative rating and avoid substituting an inferred vector in vulnerability-management systems.
The authentication requirement matters for prioritization but does not make the issue low risk. Editor credentials may be phished, reused, exposed through password compromise, or assigned to contractors and integrations. Where an editor account can write into a web-executable location, the compromise path may progress from application access to server-side code execution.
Exploitation Status
The available evidence does not confirm exploitation in the wild. CVE-2026-105123 is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no CISA date added, remediation deadline, required action, or ransomware-campaign flag applies.
Public technical disclosure exists through the NVD record, the upstream GitHub issue, and references to the vulnerable source locations. The supplied research did not identify a separate confirmed public exploit repository or standalone proof-of-concept. The current status is: public vulnerability details are available; a separate public PoC was not confirmed; active exploitation was not confirmed.
Absence from CISA KEV is not proof that exploitation has never occurred. It means CISA has not listed the CVE at the time of assessment. Because the attack requires an editor account and can be difficult to distinguish from legitimate media management, organizations should investigate suspicious activity rather than wait for KEV inclusion.
How to Detect It
Start with web-server and application logs covering requests to the media upload and delete endpoints. Look for unusual path encoding, repeated failed requests, PHP uploads, and delete operations that target names or directories outside the normal media tree. Requests containing encoded traversal markers are particularly relevant, although attackers may use multiple encoding layers or alternate path representations.
A basic web-server search can identify high-value indicators:
grep -Eai \
'/(api/v0/media/(upload|[^ ]+)).*(%2e|%252e|%2f|%5c|\.\./|%2e%2e)|DELETE[[:space:]].*/api/v0/media/' \
/var/log/nginx/access.log /var/log/apache2/access.log
The exact access-log format varies, so validate the pattern against local logs. Search for successful upload responses followed by requests for newly created PHP files:
grep -Eai \
'POST[[:space:]]+/api/v0/media/upload/|GET[[:space:]]+/[^[:space:]]+\.php|DELETE[[:space:]]+/api/v0/media/' \
/var/log/nginx/access.log /var/log/apache2/access.log
These searches are triage indicators, not definitive proof of compromise. Review the authenticated username, source IP, user agent, response status, request body metadata, and timestamps. Correlate suspicious API activity with filesystem events and PHP process creation. On Linux, inspect recently changed PHP files outside the expected application locations:
find /var/www -type f -name '*.php' -mtime -14 -printf '%TY-%Tm-%Td %TH:%TM %u %p\n' 2>/dev/null
Look for PHP files in media or upload directories, unexpected modifications to application files, new cron entries, altered web-server configuration, and outbound connections from the web process. Preserve relevant logs and filesystem metadata before deleting suspected payloads.
Where endpoint protection is part of the response plan, teams can compare capabilities in a current antivirus guide for freelancers, but endpoint scanning should supplement—not replace—server-side log review and filesystem inspection.
Mitigation and Patching
No confirmed fixed version was identified in the supplied NVD data, upstream references, or research results. The confirmed affected range is through 3.18.0, and no specific fixed version number can responsibly be provided. Administrators should monitor the upstream repository and issue tracker for a release that explicitly addresses CVE-2026-105123. Do not assume that upgrading beyond 3.18.0 is sufficient unless the project documents that release as fixed.
Until a fixed release is confirmed, restrict editor access to the smallest practical group, disable dormant accounts, rotate potentially exposed editor credentials, and require strong authentication where available. Place the media directory outside the executable web root when the deployment permits it. Configure the web server and PHP handler so that uploaded content cannot be interpreted as PHP.
For example, an Apache deployment can disable PHP handling in a media directory with a directory-specific configuration, subject to local module and hosting practices:
<Directory "/var/www/wcms/media">
Options -ExecCGI
RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .php8
RemoveType .php .phtml .php3 .php4 .php5 .php7 .php8
</Directory>
A commonly used Nginx control is to ensure the PHP location block does not match the media path, while denying script-like extensions there:
location ~* ^/media/.*\.(php|phtml|phar)$ {
return 403;
}
Test these examples against the site’s actual document-root, alias, and PHP-FPM configuration. They are compensating controls, not a replacement for application remediation. Review filesystem permissions so the W/wcms process cannot write to application code, server configuration, SSH material, cron locations, or other sensitive directories. Back up known-good files, inspect for unauthorized changes, and consider isolating or temporarily disabling the media API if business requirements allow it.
When an upstream fixed release is confirmed, use the project’s documented upgrade process rather than inventing a package command for a repository-specific deployment. At minimum, record the current version, back up the database and application files, test the upgrade in a staging environment, deploy the fixed release, and verify that canonicalized paths cannot escape the media directory. Continue monitoring after the upgrade for evidence of earlier compromise.
References
The primary record is the NVD entry for CVE-2026-105123, which identifies the affected product, version range, CVSS score, and vulnerable API behavior.
Additional technical references include the W/wcms GitHub repository, the cited Controllerapimedia.php code, and the referenced Media.php location.
For upstream status, monitor GitHub issue #662 and the W/wcms project repository. The CISA Known Exploited Vulnerabilities Catalog should also be checked periodically for a change in exploitation status. A related advisory is available from VulnCheck.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.