Jarosław Wawiórko

Authenticated users can execute arbitrary shell commands with root privileges. This is possible by providing a malicious payload in the "IP address" field of the diagnosis test tools.

FluentCMS version 2026 has a stored cross-site scripting issue. Authenticated administrators can upload SVG files containing JavaScript through the File Management module. An attacker can upload a malicious SVG file, and when a user accesses the file’s URL, JavaScript will execute in their browser. The vulnerable module is the File Management module, and the attack vector involves uploading SVG files.