medium4.7
CVE-2026-2666
mingSoft MCMS does not properly restrict file uploads
Impact
A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the component Template Archive Handler. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | net.mingsoft:ms-mcms | <= 6.1.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mingsoft | Mcms | Version 6.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/chujianxin0101/vuln/issues/11
- https://github.com/chujianxin0101/vuln/issues/11#issue-3905144613
- https://vuldb.com/?ctiid.346463
- https://vuldb.com/?id.346463
- https://vuldb.com/?submit.753243
- https://github.com/advisories/GHSA-r9wp-qq53-qvjx
- https://nvd.nist.gov/vuln/detail/CVE-2026-2666