CVE-2026-112027CWE-200CWE-538information-disclosure

CVE-2026-112027

Medium · published October 19, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
25.7
In the wild
Unconfirmed
What it is

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file_exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the argument filename results in file and directory information exposure. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00335 · 25.7th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory
Published
2026-10-19T03:16Z
References (6)
https://github.com/light0011/cms/ · [email protected]https://github.com/light0011/cms/issues/15 · [email protected]https://vuldb.com/cve/CVE-2026-112027 · [email protected]https://vuldb.com/submit/1008072 · [email protected]https://vuldb.com/vuln/421675 · [email protected]https://vuldb.com/vuln/421675/cti · [email protected]
EPSS history
Timeline
  • 20 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 18 OCT 22:30Z
    light0011 cms Uploadify check-exists.php file_exists file information disclosure
    cvelistv5
  • 18 OCT 22:30Z
    light0011 cms Uploadify check-exists.php file_exists file information disclosure
    cvelistv5