CVE-2026-91849

Name of the Vulnerable Software and Affected Versions WuzhiCMS versions prior to 4.1.1

Description A flaw in the Avatar Upload component allows remote attackers to perform unrestricted file uploads. This occurs through the manipulation of the File argument within the member::setAvatar() function, accessed via the '/index.php?m=member&f=user&v=setAvatar' endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/index.php?m=member&f=user&v=setAvatar' endpoint or disable the member::setAvatar() function.