CVE-2026-88419

Name of the Vulnerable Software and Affected Versions WuzhiCMS version 5.0.0

Description An unrestricted file upload issue exists in the thumbnail-upload endpoint '/index.php?m=member&f=article&v=thumbUpload'. An authenticated low-privileged member can upload a crafted .php file to execute arbitrary PHP code on the server. This occurs because the system accepts the client-supplied filename extension without using an allowlist or performing content validation, saving the file to the web-accessible uploadfile/ directory where the web server executes PHP.

Recommendations Update WuzhiCMS version 5.0.0 to a version that addresses this issue. As a temporary mitigation, restrict access to the '/index.php?m=member&f=article&v=thumbUpload' endpoint.