CVE-2026-112027: fallo de gravedad media en light0011 cms
light0011 cms Uploadify check-exists.php file_exists file information disclosure
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 6.9epss 0.3%
A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file_exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the argument filename results in file and directory information exposure. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
light0011 · cmsPoCs públicas encontradas — 1
cve_referencegithub.com/light0011/cms/issues/15no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — light0011 cms
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-86306MEDIUMlight0011 cms Cookie Helper UserModel.class.php improper authenticationEPSS 0.7%CVE-2026-85381MEDIUMlight0011 cms Chapter Controller ChapterController.class.php authorizationEPSS 0.6%CVE-2026-86308MEDIUMlight0011 cms Debug Mode config.php information disclosureEPSS 0.5%CVE-2026-85378MEDIUMlight0011 cms Chapter Controller ChapterController.class.php _initialize authorizationEPSS 0.5%CVE-2026-86305MEDIUMlight0011 cms Upload.class.php upload unrestricted uploadEPSS 0.5%CVE-2026-85380MEDIUMlight0011 cms UEditor controller.php catchimage server-side request forgeryEPSS 0.5%