CVE-2026-0566: code-projects Content Management System edit_posts.php unrestricted file upload
An unrestricted upload issue has been reported in code-projects Content Management System 1.0, in the /admin/edit_posts.php component through the image argument. NVD lists a CVSS base score of 9.8, and the record states that the attack can be carried out remotely and that the exploit has been publicly disclosed. The consulted record lists no fix and the vulnerability is not in the CISA KEV catalog.
Overview
The record describes an unrestricted upload weakness (CWE-434) in code-projects Content Management System 1.0. The affected component is the /admin/edit_posts.php file, where the image argument is involved. The CNA is VulDB, and NVD has also analyzed the record.
Impact
- NVD lists a CVSS base score of 9.8, which is the highest score in the record.
- VulDB and cna@vuldb.com list lower scores, from 2 up to 5.8, so the severity depends on the scoring source.
- Unrestricted upload can allow an attacker to place files on a server, with consequences that depend on how the application stores and serves uploaded files. The record does not describe the specific impact in detail.
Affected products and versions
- Code-projects Content Management System, version 1.0 only, according to the record.
- No other versions are listed as affected in the consulted sources.
Exploitation status
- The record states that the exploit has been publicly disclosed.
- The vulnerability is not listed in CISA KEV in the record, so no confirmed active exploitation appears in the sources consulted.
- The SSVC exploitation field in the record is poc, which indicates proof-of-concept status rather than confirmed attacks.
- The EPSS probability in the record is 0.00355, with a percentile of 0.28074.
Remediation and mitigation
- No fixed version is listed in the record. The absence of a listed fix does not confirm that no fix exists; check the vendor and project maintainers for updates.
- Until an official correction is confirmed, restrict access to the administrative area and limit who can use the post editing functions.
- Validate file type, size and content on the server side, store uploads outside the web root when possible, and do not execute uploaded files.
Detection guidance
- Review web server and application logs for requests to /admin/edit_posts.php, especially those with unexpected file uploads.
- Monitor the upload directories for files with unexpected extensions or content types, and for newly created executable or script files.
- Alert on administrative sessions that upload files outside normal editorial activity.
Limitations of the available information
- The record does not identify the vulnerable function inside edit_posts.php or the accepted file types.
- No vendor patch or fixed version is listed in the record.
- The record does not give confirmed exploitation counts or real-world incidents.
- The EPSS date in the record is later than the publication date and should be verified against the source.
Frequently asked questions
Is this vulnerability being actively exploited?
The record is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been disclosed.
Which versions are affected?
The record lists only code-projects Content Management System version 1.0 as affected.
Is there an official fix?
No fixed version is listed in the record. Check the vendor or project maintainers for any update, since the absence of a listed fix does not confirm that none exists.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.