EIP-2026-106039

PRE-CVE

cmsWorks 2.2 RC4 - 'FCKeditor' Arbitrary File Upload

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-106039. PoCs published by Stack.

AI-analyzed exploit summary This PHP script exploits a file upload vulnerability in cmsWorks 2.2 RC4 by bypassing extension checks in the FCKeditor component, allowing arbitrary PHP code execution. It uploads a malicious file with a double extension (e.g., .php.zip) and provides a shell interface for command execution.

Description

cmsWorks 2.2 RC4 - 'FCKeditor' Arbitrary File Upload

Exploits (1)

exploitdb WORKING POC VERIFIED
by Stack · phpwebappsphp
https://www.exploit-db.com/exploits/5922

This PHP script exploits a file upload vulnerability in cmsWorks 2.2 RC4 by bypassing extension checks in the FCKeditor component, allowing arbitrary PHP code execution. It uploads a malicious file with a double extension (e.g., .php.zip) and provides a shell interface for command execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: cmsWorks 2.2 RC4
No auth needed
Prerequisites: Target must have mod_mime installed · FCKeditor must be accessible
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026