CVE-2026-57658: TemplateSpare Arbitrary File Upload Vulnerability
CVE-2026-57658 describes an administrator-level arbitrary file upload flaw in TemplateSpare versions up to and including 4.2.0, reported by Patchstack and classified as CWE-434. The CNA assigned a CVSS 3.1 base score of 9.1 (critical). The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted, and it provides no structured fixed version.
Overview
CVE-2026-57658 describes an arbitrary file upload issue in TemplateSpare versions up to and including 4.2.0, published by the CNA audit@patchstack.com. The record classifies the weakness as CWE-434 (Unrestricted Upload of File with Dangerous Type). The reference link points to a Patchstack database entry under a WordPress plugin path, which suggests TemplateSpare is a WordPress extension (inference).
Impact
The CNA assigned a CVSS 3.1 base score of 9.1 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Per this vector, the attack is network-reachable with low complexity, requires high privileges, needs no user interaction, changes scope, and has high impact on confidentiality, integrity and availability. Whether an uploaded file can be executed by the server is not stated in the record (unknown).
Affected products and versions
- Product: TemplateSpare.
- Versions described: 4.2.0 and earlier.
- The record contains no structured list of affected or fixed versions, so the exact range must be confirmed in the Patchstack entry.
Exploitation status
The CISA KEV entry in the record is not listed. No confirmed exploitation in the wild appears in the sources consulted. The FIRST EPSS estimate is a probability of 0.00499 with a percentile of 0.41099, which is an statistical estimate and not evidence of exploitation.
Remediation and mitigation
- No fixed version is listed in the record. The absence of a listed fix does not mean none exists; check the Patchstack entry and the vendor for an updated release.
- If the vendor provides a version newer than 4.2.0, plan an update after testing in a non-production environment.
- If no fix is confirmed, consider disabling or removing the component until a vendor update is available.
- Restrict administrator accounts to the minimum necessary, enforce strong passwords and multi-factor authentication, and review who can upload files.
- Where feasible, prevent script execution in upload directories.
Detection guidance
- Review upload directories for unexpected files, especially server-side script types, created or modified without a known change.
- Audit recent administrator logins, new administrator accounts and permission changes.
- Review web server logs for unusual upload requests directed at the plugin.
- Compare file integrity against a known-good baseline.
Limitations of the available information
The record provides no structured affected or fixed version list, no vendor advisory text, no details of the upload path or validation logic, and no CVSS data beyond the CNA score. The product type is inferred from the reference URL. Verify all details against the NVD entry and the Patchstack page before acting.
Frequently asked questions
What is CVE-2026-57658?
It is an administrator-level arbitrary file upload vulnerability in TemplateSpare versions up to and including 4.2.0, classified as CWE-434.
Is this vulnerability known to be exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Is there a fixed version?
The record lists no fixed version. Check the Patchstack entry and the vendor for an updated release before concluding none exists.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.