CVE-2026-35047

CRITICAL

Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint

Title source: cna
STIX 2.1

Description

Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allows attackers to upload arbitrary files, including executable scripts. This may lead to Remote Code Execution (RCE) on the server, potentially resulting in full system compromise, data exfiltration, or service disruption. All users running affected versions of BraveCMS are impacted. This vulnerability is fixed in 2.0.6.

References (3)

Core 3

Scores

CVSS v3 9.8
EPSS 0.0055
EPSS Percentile 41.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-434
Status published
Products (2)
ajax30/bravecms 2.0.0 - 2.0.6
Ajax30/BraveCMS-2.0 < 2.0.6
Published Apr 06, 2026
Tracked Since Apr 06, 2026