Summary
A high-severity unrestricted file upload vulnerability in WCMS allows authenticated editors to write attacker-controlled files through the media upload API. If the web server can execute uploaded script files, or if path handling permits writes outside the intended media directory, an attacker may achieve remote code execution, overwrite files, or delete unrelated files.
Affected context
The vulnerability occurs in WCMS versions through 3.18.0 when the media API accepts an editor-controlled path for upload or deletion without sufficiently restricting it to the intended media directory. Risk is higher when uploaded files are stored in a web-accessible, executable location or when encoded traversal sequences are normalized after authorization checks.
Exploit preconditions
- Attack surface: The media upload and deletion endpoints under
/api/v0/media/ - Required access: An authenticated account with editor-level permissions or equivalent access to the media API
- Trigger point: File upload or deletion using a caller-controlled path
- Why exploitation is possible: The destination path and file type are not adequately constrained, allowing executable files to be stored or paths to escape the intended media directory
Why this happens
The underlying bug is insufficient validation and containment of user-controlled file paths and uploaded content. The application permits an authenticated user to influence the destination path without reliably enforcing filename, extension, canonical-path, and storage-boundary rules. This maps primarily to CWE-434: Unrestricted Upload of File with Dangerous Type; path traversal and arbitrary file deletion are related consequences of inadequate filesystem access control.
Potential impact
- An attacker may execute server-side code through an uploaded script
- The web application may be fully compromised
- Sensitive files may be overwritten, exposed, or deleted
- Application content or configuration may be tampered with
- The host or connected services could be used for lateral movement
General mitigation guidance
Mitigation generally focuses on separating user-controlled media from executable application content and enforcing strict filesystem boundaries.
Common defensive patterns include:
- Store uploads outside web-served and server-executable directories
- Permit only an explicit allowlist of safe file types and validate content independently of the filename
- Canonicalize paths before authorization and require them to remain within a dedicated upload directory
- Generate server-side filenames instead of accepting unrestricted names or paths
- Apply separate, narrowly scoped permissions to upload and deletion operations
- Use least-privilege identities for the web process and restrict filesystem write access
- Return non-executable content types for media responses and apply defense-in-depth web-server restrictions
How teams detect issues like this
Detection approaches can include:
- Static analysis for file writes using request parameters, unsafe path joins, and weak extension checks
- Code review for upload handlers that trust client-supplied paths, filenames, or MIME types
- Tests using traversal variants, canonicalization edge cases, executable extensions, and double-encoded paths
- Runtime monitoring for script files or unexpected extensions appearing in media directories
- File-integrity monitoring for changes outside approved upload locations
- Policy enforcement that blocks executable content and prevents web processes from writing application code
Automated security scanning and code-review tools may help identify these patterns during development.
