Description

A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T08:17:19.020Z",
  "pubdate": "2026-10-12T08:17:19.020Z",
  "executiveSummary": "An information disclosure vulnerability has been identified in WMCMS version 4.446.1257, residing within the /index.php script. This flaw allows remote, unauthenticated attackers to manipulate specific file path parameters, leading to the unauthorized exposure of sensitive system information.\nThe vulnerability is classified as an information disclosure issue, which can expose internal file structures, configuration details, or sensitive data residing on the server filesystem. Because the exploit vector is publicly available, the risk to organizations running this specific version is considered high.\nThe attack can be performed remotely over the network, requiring no prior authentication or administrative privileges. Successful exploitation facilitates reconnaissance activities, which may serve as a precursor to more severe attacks, such as unauthorized data exfiltration or system compromise. Systems running WMCMS 4.446.1257 are susceptible to these unauthorized information retrieval requests, necessitating immediate defensive action to prevent potential exploitation.",
  "technicalDetails": "The vulnerability originates from improper input validation within the /index.php file of WMCMS 4.446.1257. Specifically, the application fails to adequately sanitize or restrict user-supplied input provided to parameters related to file or path navigation.\nDuring typical operation, the application processes user requests via /index.php to dynamically serve content. The vulnerability occurs when an attacker crafts a malicious request that manipulates path-related arguments. By injecting directory traversal sequences or providing unexpected file paths, an attacker can bypass intended access controls.\nThe root cause is an insufficient implementation of path sanitization, which permits the application to resolve and disclose the contents of files that should otherwise remain restricted or inaccessible to web users. When the manipulated path is processed by the underlying server-side logic, the application may echo the contents of the targeted file directly into the HTTP response body.\nThe attack flow proceeds as follows: 1) The attacker identifies the vulnerable endpoint at /index.php. 2) The attacker crafts an HTTP request containing a manipulated path/file argument designed to point to sensitive files on the server. 3) The application, lacking restrictive input validation, accepts the malicious path and performs a read operation on the targeted file. 4) The server returns the file contents to the attacker within the response, effectively disclosing sensitive information such as server configuration, environment variables, or other sensitive source code fragments.\nThe vulnerability is remotely exploitable over HTTP/HTTPS protocols and does not require the attacker to have an active session or specific system privileges. The exploit, which is currently publicly documented, demonstrates that the lack of a whitelist-based validation mechanism or proper path normalization permits arbitrary file access within the scope of the web server's permissions. The post-exploitation impact includes the loss of confidentiality regarding internal system architecture and configuration secrets, which facilitates further exploitation vectors against the host environment."
}