GHSA-r9wp-qq53-qvjx

ghsaUSosv

mingSoft MCMS does not properly restrict file uploads

view advisory published 2026-02-18Licence: CC-BY-4.0

A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the component Template Archive Handler. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-2666US	high7.2	0.41% (35th)	—	2026-02-18
A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the component Template Archive Handler. Executin…

references

External citations — patches, advisories, analysis.

https://github.com/chujianxin0101/vuln/issues/11WEB
https://github.com/ming-soft/MCMSPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2026-2666ADVISORY
https://vuldb.com/?ctiid.346463WEB
https://vuldb.com/?id.346463WEB
https://vuldb.com/?submit.753243WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan