CVEvulnerability

CVE-2026-36467

7.2 HIGH Published 2026-09-21 Modified 2026-09-22 Official page ↗

Status: Deferred
Published: 2026-09-21
Last modified: 2026-09-22
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-434

Description

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell.

Weakness · CWE (1)

CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References

https://github.com/CuteNews/cutenews-2.0 github.com
https://github.com/CuteNews/cutenews-2.0/blob/master/core/modules/media.php github.com
https://github.com/UmbraDeorum/cutenews-2.0-CVEs-2026-Disclosure github.com

CVE-2026-36467

Description

Related

Weakness · CWE (1)

References