CVE-2026-57311

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57311", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-06-24T12:12:42.195Z", "datePublished": "2026-07-20T12:53:08.554Z", "dateUpdated": "2026-07-29T09:42:56.327Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-07-29T09:42:56.327Z"}, "title": "Unrestricted Upload of File with Dangerous Type in Windu CMS", "datePublic": "2026-07-20T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "affected": [{"vendor": "JCD", "product": "Windu CMS", "versions": [{"status": "affected", "version": "4.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary\u00a0files, including PHP. This can lead to Remote Code Execution.\n\nBecause vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary&nbsp;files, including PHP. <span>This can lead to Remote Code Execution.</span><br><br>Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.<br>"}]}], "references": [{"url": "https://cert.pl/posts/2026/07/CVE-2026-57309", "tags": ["third-party-advisory"]}, {"url": "https://windu.org", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L"}}], "credits": [{"lang": "en", "value": "Jakub Lipi\u0144ski", "type": "finder"}, {"lang": "en", "value": "Marek To\u0142czyk", "type": "finder"}, {"lang": "en", "value": "Kamil Kr\u00f3likowski", "type": "finder"}, {"lang": "en", "value": "Karol Czubernat", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T13:45:57.751479Z", "id": "CVE-2026-57311", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T13:46:09.348Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57311", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T13:45:57.751479Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T13:46:03.170Z"}}], "cna": {"title": "Unrestricted Upload of File with Dangerous Type in Windu CMS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Jakub Lipi\u0144ski"}, {"lang": "en", "type": "finder", "value": "Marek To\u0142czyk"}, {"lang": "en", "type": "finder", "value": "Kamil Kr\u00f3likowski"}, {"lang": "en", "type": "finder", "value": "Karol Czubernat"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "JCD", "product": "Windu CMS", "versions": [{"status": "affected", "version": "4.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "datePublic": "2026-07-20T00:00:00.000Z", "references": [{"url": "https://cert.pl/posts/2026/07/CVE-2026-57309", "tags": ["third-party-advisory"]}, {"url": "https://windu.org", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary\u00a0files, including PHP. This can lead to Remote Code Execution.\n\nBecause vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.", "supportingMedia": [{"type": "text/html", "value": "Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary&nbsp;files, including PHP. <span>This can lead to Remote Code Execution.</span><br><br>Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-07-29T09:42:56.327Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57311", "state": "PUBLISHED", "dateUpdated": "2026-07-29T09:42:56.327Z", "dateReserved": "2026-06-24T12:12:42.195Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-07-20T12:53:08.554Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Windu CMS", "vendor": "JCD", "versions": [{"status": "affected", "version": "4.1", "versionType": "custom"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary\u00a0files, including PHP. This can lead to Remote Code Execution.\n\nBecause vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions."}, {"lang": "es", "value": "Windu CMS no valida los tipos de archivos subidos. Un atacante autenticado puede subir archivos arbitrarios, incluyendo PHP. Esto puede llevar a ejecuci\u00f3n remota de c\u00f3digo.\n\nDebido a que los intentos de contacto con el proveedor no tuvieron \u00e9xito, la vulnerabilidad solo se ha confirmado en la versi\u00f3n 4.1 pero tambi\u00e9n puede afectar a otras versiones."}], "id": "CVE-2026-57311", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57311", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T13:45:57.751479Z", "version": "2.0.3"}}]}, "published": "2026-07-20T13:16:56.633", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/posts/2026/07/CVE-2026-57309"}, {"source": "cvd@cert.pl", "url": "https://windu.org"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Windu CMS", "source": "cna", "vendor": "JCD"}, "product": "windu_cms", "vendor": "jcd"}], "created": "2026-07-21T21:00:13.120367+00:00", "updated": "2026-07-30T19:30:09.710050+00:00", "vendors": ["jcd", "jcd$PRODUCT$windu_cms"]}