CVE-2026-92895

Name of the Vulnerable Software and Affected Versions Live2DWebCanvas versions prior to 2.2.2

Description An arbitrary file upload issue exists in the download one file() function. The flaw stems from a lack of MIME type validation and a missing file extension whitelist when writing files based on attacker-controlled manifest entries to the plugin directory. Unauthenticated attackers can upload executable files, potentially leading to remote code execution if the apiType setting is configured as custom-local (self-hosted model mode). This specific configuration is a non-default option requiring a paid license that exposes the REST nonce and one-time session tokens on front-end pages.

Recommendations Update Live2DWebCanvas to version 2.2.2 or later. As a temporary mitigation, avoid using the custom-local configuration for the apiType setting.