CVE-2026-15518

Name of the Vulnerable Software and Affected Versions AREA 17 Twill CMS versions prior to 3.6.1

Description An unrestricted upload issue exists in the Media Library Insert Page component. A remote attacker can exploit this by manipulating the qqfilename argument within the FileLibraryController::storeFile() function located in the src/Http/Controllers/Admin/FileLibraryController.php file.

Recommendations As a temporary workaround, restrict access to the FileLibraryController::storeFile() function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.