CVE-2026-6561

MEDIUM

EyouCMS Index.php edit_adminlogo unrestricted upload

Title source: cna

Description

A vulnerability was detected in EyouCMS up to 1.7.1. This issue affects the function edit_adminlogo of the file application/admin/controller/Index.php. Performing a manipulation of the argument filename results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

[Vdb Entry, Technical Description] https://vuldb.com/vuln/358198

[Signature, Permissions Required] https://vuldb.com/vuln/358198/cti

[Third Party Advisory] https://vuldb.com/submit/788038

[Exploit] https://github.com/zzk6th/my-cve-notes/blob/main/EyouCMS%20Arbitrary%20File%20Copy%20Vulnerability%20in%20edit_adminlogo()%20Leading%20to%20Sensitive%20Information%20Disclosure.md

View Exploit ZIP pw:eip

Scores

CVSS v3 4.7

EPSS 0.0001

EPSS Percentile 1.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Details

CWE

CWE-284 CWE-434

Status published

Products (2)

None/EyouCMS 1.7.0

None/EyouCMS 1.7.1

Published Apr 19, 2026

Tracked Since Apr 19, 2026