CVE-2026-112027

A flaw was found in the Uploadify component of light0011 cms. A remote attacker can exploit an improper input handling vulnerability by manipulating the filename parameter in the check-exists script. This issue leads to information disclosure, allowing the attacker to verify the existence of arbitrary files and directories on the server.

Red Hat has evaluated this vulnerability as Moderate because it enables remote attackers to enumerate file and directory paths without granting the ability to read file contents, modify data, or execute commands. The impact is limited to metadata discovery regarding the server filesystem, constraining the overall blast radius. Additionally, this third-party content management software is not included in standard Red Hat product distributions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.