CVE Watch13 jul 2026

CVE-2026-15518

A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of th

CVSS

4.7

Medio

EPSS

0.2%

p16

KEV

—

Exploit Today

0-100

Publicado: 13 jul 2026 · Última mod.: 13 jul 2026 · CWE-284 · CWE-434

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-07-132026-07-20

Descripción técnica

A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Admin/FileLibraryController.php of the component Media Library Insert Page. Such manipulation of the argument qqfilename leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-562919.8 CRÍ

94.5%

KEV—78Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability10d CVE-2026-562909.8 CRÍ

85.5%

KEV—76Joomlack Page Builder Improper Access Control Vulnerability13d CVE-2026-489089.8 CRÍ

72.6%

KEV—72JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability13d CVE-2026-489399.8 CRÍ

71.5%

KEV—71iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability10d CVE-2023-388368.8 ALT

99.3%

——30File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.12d CVE-2023-464747.2 ALT

97.3%

——29File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_import.php file.12d