Exploitation Summary
EIP tracks 1 public exploit for CVE-2026-1107. PoCs published by Iniivan13.
AI-analyzed exploit summary This repository contains a Nuclei template for detecting CVE-2026-1107, a path traversal vulnerability in EyouCMS < 1.7.1. The template sends a crafted POST request to read the source code of 'index.php' via the 'viewfile' parameter, confirming the vulnerability if PHP tags are returned.
Description
A weakness has been identified in EyouCMS up to 1.7.1/5.0. Impacted is the function check_userinfo of the file Diyajax.php of the component Member Avatar Handler. Executing a manipulation of the argument viewfile can lead to unrestricted upload. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Exploits (1)
This repository contains a Nuclei template for detecting CVE-2026-1107, a path traversal vulnerability in EyouCMS < 1.7.1. The template sends a crafted POST request to read the source code of 'index.php' via the 'viewfile' parameter, confirming the vulnerability if PHP tags are returned.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L