CVE-2026-109219

Name of the Vulnerable Software and Affected Versions Mang Board versions prior to 2.4.5

Description The plugin allows unauthenticated attackers to perform arbitrary file uploads through the mbw file upload() function. The issue stems from a lack of file extension validation on the image path parameter, which allows the basename-derived filename to bypass the extension allowlist that is only applied to the file name parameter. This can lead to remote code execution if executable files are uploaded. This flaw is exploitable when the board is configured to allow guest posts, which is the default setting, as the necessary nonce is visible on all public board pages.

Recommendations Update to a version newer than 2.4.4. As a temporary mitigation, disable the ability for guests to create posts on the board.