CVE-2026-36467

Published: Sep 21, 2026Modified: Sep 22, 2026Deferred

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell.

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (3)

https://github.com/CuteNews/cutenews-2.0

Source: cve@mitre.org

https://github.com/CuteNews/cutenews-2.0/blob/master/core/modules/media.php

Source: cve@mitre.org

https://github.com/UmbraDeorum/cutenews-2.0-CVEs-2026-Disclosure

Source: cve@mitre.org

Timeline

No history available yet.