CVE-2026-15518CWE-284CWE-434

AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload

Medium · published July 13, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
30.4
In the wild
Unconfirmed
What it is

A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Admin/FileLibraryController.php of the component Media Library Insert Page. Such manipulation of the argument qqfilename leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00376 · 30.4th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-07-13T00:45Z
EPSS history
Timeline
  • 13 JUL 00:45Z
    AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload
    cvelistv5