CVE-2026-35047
CRITICALBrave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint
Title source: cnaDescription
Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allows attackers to upload arbitrary files, including executable scripts. This may lead to Remote Code Execution (RCE) on the server, potentially resulting in full system compromise, data exfiltration, or service disruption. All users running affected versions of BraveCMS are impacted. This vulnerability is fixed in 2.0.6.
References (3)
Scores
CVSS v3
9.8
EPSS
0.0033
EPSS Percentile
56.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-434
Status
published
Products (2)
ajax30/bravecms
2.0.0 - 2.0.6
Ajax30/BraveCMS-2.0
< 2.0.6
Published
Apr 06, 2026
Tracked Since
Apr 06, 2026