CVE-2026-16601

Name of the Vulnerable Software and Affected Versions CM Map Locations – Visualize and share your locations in a few clicks versions prior to 2.1.9

Description Insufficient file type validation in the upload handler allows authenticated attackers with subscriber-level access and above to perform a limited arbitrary file upload. The issue occurs within the uploadMedia() function, which uses incomplete extension filtering and fails to perform MIME-type checks or verify upload capabilities before calling move uploaded file(). This can lead to remote code execution if executable files are uploaded. The required nonce is exposed to logged-in subscribers through the CMLOC Editor Images JavaScript object on the front-end location editor page.

Recommendations Update to a version newer than 2.1.8. As a temporary mitigation, restrict access to the front-end location editor page for users with subscriber-level permissions.