CVE-2026-57311 - Vulnerability Details - OpenCVE

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Jcd	Windu Cms

No data.

No data.

References

Link	Providers
https://cert.pl/posts/2026/07/CVE-2026-57309
https://windu.org

History

Thu, 23 Jul 2026 21:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Jcd Jcd windu Cms
Vendors & Products		Jcd Jcd windu Cms

Mon, 20 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 20 Jul 2026 13:00:00 +0000

Type	Values Removed	Values Added
Description		Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.
Title		Unrestricted Upload of File with Dangerous Type in Windu CMS
Weaknesses		CWE-434
References		https://cert.pl/posts/2026/07/CVE-2026-57309 https://windu.org
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L'}`

MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published: 2026-07-20T12:53:08.554Z

Updated: 2026-07-29T09:42:56.327Z

Reserved: 2026-06-24T12:12:42.195Z

Link: CVE-2026-57311

Vulnrichment

Updated: 2026-07-20T13:46:03.170Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57311", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-06-24T12:12:42.195Z", "datePublished": "2026-07-20T12:53:08.554Z", "dateUpdated": "2026-07-29T09:42:56.327Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-07-29T09:42:56.327Z"}, "title": "Unrestricted Upload of File with Dangerous Type in Windu CMS", "datePublic": "2026-07-20T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "affected": [{"vendor": "JCD", "product": "Windu CMS", "versions": [{"status": "affected", "version": "4.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary\u00a0files, including PHP. This can lead to Remote Code Execution.\n\nBecause vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. <span>This can lead to Remote Code Execution.</span><br><br>Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.<br>"}]}], "references": [{"url": "https://cert.pl/posts/2026/07/CVE-2026-57309", "tags": ["third-party-advisory"]}, {"url": "https://windu.org", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L"}}], "credits": [{"lang": "en", "value": "Jakub Lipi\u0144ski", "type": "finder"}, {"lang": "en", "value": "Marek To\u0142czyk", "type": "finder"}, {"lang": "en", "value": "Kamil Kr\u00f3likowski", "type": "finder"}, {"lang": "en", "value": "Karol Czubernat", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T13:45:57.751479Z", "id": "CVE-2026-57311", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T13:46:09.348Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57311", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T13:45:57.751479Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T13:46:03.170Z"}}], "cna": {"title": "Unrestricted Upload of File with Dangerous Type in Windu CMS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Jakub Lipi\u0144ski"}, {"lang": "en", "type": "finder", "value": "Marek To\u0142czyk"}, {"lang": "en", "type": "finder", "value": "Kamil Kr\u00f3likowski"}, {"lang": "en", "type": "finder", "value": "Karol Czubernat"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "JCD", "product": "Windu CMS", "versions": [{"status": "affected", "version": "4.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "datePublic": "2026-07-20T00:00:00.000Z", "references": [{"url": "https://cert.pl/posts/2026/07/CVE-2026-57309", "tags": ["third-party-advisory"]}, {"url": "https://windu.org", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary\u00a0files, including PHP. This can lead to Remote Code Execution.\n\nBecause vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.", "supportingMedia": [{"type": "text/html", "value": "Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. <span>This can lead to Remote Code Execution.</span><br><br>Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-07-29T09:42:56.327Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57311", "state": "PUBLISHED", "dateUpdated": "2026-07-29T09:42:56.327Z", "dateReserved": "2026-06-24T12:12:42.195Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-07-20T12:53:08.554Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}