GitHub Advisoryadvisory · Maven

GHSA-r9wp-qq53-qvjx mingSoft MCMS does not properly restrict file uploads

LOW Published 2026-02-18 Modified 2026-02-19 Official page ↗
Aliases
CVE-2026-2666
Ecosystem
Maven
Packages
net.mingsoft:ms-mcms
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-284
Reviewed
2026-02-19

Affected packages

• Maven net.mingsoft:ms-mcms: <= 6.1.1 (no fix yet)

Description

A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the component Template Archive Handler. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.

Related

Alias · CVE (1)

  • CVE-2026-2666 A flaw has been found in mingSoft MCMS 6.1.1. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References