CVE-2026-108811
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-200, CWE-284
Impact
Authenticated remote attackers can read arbitrary server files. Exploitation requires network access and a low-privilege user account.
Root cause
Improper input validation on the path/file argument in /index.php allows path traversal and unauthorized file reads.
Affected systems
WMCMS 4.446.1257
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
No fixed release is documented. Restrict network access to the application or block requests with path traversal patterns targeting /index.php at the reverse proxy or WAF.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.