CVE WatchJul 13, 2026

CVE-2026-15518

A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of th

CVSS

4.7

Medium

EPSS

0.2%

p16

KEV

—

Exploit Today

0-100

Published: Jul 13, 2026 · Last modified: Jul 13, 2026 · CWE-284 · CWE-434

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-132026-07-20

Technical description

A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Admin/FileLibraryController.php of the component Media Library Insert Page. Such manipulation of the argument qqfilename leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-562919.8 CRI

94.5%

KEV—78Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability10d CVE-2026-562909.8 CRI

85.5%

KEV—76Joomlack Page Builder Improper Access Control Vulnerability12d CVE-2026-489089.8 CRI

72.6%

KEV—72JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability12d CVE-2026-489399.8 CRI

71.5%

KEV—71iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability10d CVE-2023-388368.8 HIG

99.3%

——30File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.12d CVE-2023-464747.2 HIG

97.3%

——29File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_import.php file.12d