Description

A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-07T13:20:39.753Z",
  "pubdate": "2026-09-07T13:20:39.753Z",
  "executiveSummary": "A critical security flaw has been identified in the light0011 CMS, specifically affecting the Upload::upload function within the ThinkPHP framework implementation.\nThe vulnerability is categorized as an Unrestricted File Upload, which allows remote, unauthenticated attackers to execute arbitrary code on the underlying server.\nBecause the software utilizes a rolling release strategy, specific affected versions are difficult to track, but the issue persists in the commit versions c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930.\nThe exploit is publicly available, significantly increasing the risk of automated and manual exploitation by threat actors.\nSuccessful exploitation grants an attacker the ability to upload malicious scripts—such as web shells—leading to full system compromise, data exfiltration, and unauthorized lateral movement within the hosting environment.",
  "technicalDetails": "The vulnerability resides in the Upload::upload function located in ThinkPHP/Library/Think/Upload.class.php. This function serves as the central handler for processing file uploads within the CMS.\nThe root cause of the flaw is the improper validation of uploaded file characteristics, specifically the failure to enforce strict allow-lists for file extensions, MIME types, or content headers.\nThe attack flow begins when an attacker sends a crafted multipart/form-data HTTP POST request to an endpoint that invokes the vulnerable Upload::upload method. By bypassing client-side or weak server-side checks, an attacker can upload arbitrary files, including server-side executable scripts like .php, .phtml, or .php5 files.\nSince the application does not adequately verify the file contents or enforce directory restrictions upon storage, the uploaded file is written to a location accessible by the web server's runtime environment.\nOnce the file is successfully uploaded, the attacker can execute the payload by navigating to the file's URI. This action forces the web server to interpret the malicious script, granting the attacker remote code execution (RCE) capabilities with the privileges of the web server process (e.g., www-data).\nGiven the nature of the ThinkPHP implementation, the vulnerability does not explicitly require prior authentication, making it a critical threat to external-facing interfaces. The absence of a vendor response implies that the flaw remains unpatched in the current repository codebase.\nThe exploitation process is straightforward: 1) Identify the target upload endpoint; 2) Craft a POST request containing the malicious payload; 3) Send the request to bypass filter logic; 4) Trigger the execution of the uploaded script via direct URI access. Post-exploitation impact includes persistent backdoor access, unauthorized access to database credentials stored in configuration files, and complete control over the application's file system."
}