CVE-2026-110025 | slackero phpwcms up to 1.9.49/1.12.3/2.5.2 cnt23.article.inc.php sanitize_filename POST_name unrestricted upload (GHSA-2c7r-324f-fxm4)

October 13, 2026 Yanac

A vulnerability was found in slackero phpwcms up to 1.9.49/1.12.3/2.5.2. It has been classified as critical. This issue affects the function sanitize_filename of the file include/inc_front/content/cnt23.article.inc.php. This manipulation of the argument POST_name causes unrestricted upload.

This vulnerability is handled as CVE-2026-110025. The attack can be initiated remotely. There is not any exploit available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More