CVE-2026-36467: authenticated file upload leads to

CISO Take

CuteNews 2.1.2 has an unrestricted file upload flaw (CWE-434) in its Media Manager that lets an authenticated administrator-level user upload a dangerous file type and run arbitrary code on the server, including a reverse shell. The exposure is limited because it requires high privileges (PR:H), the CVSS score is 7.2, EPSS sits at 0.5% (top 57%), and there is no public exploit, Nuclei template, or CISA KEV listing. CISA SSVC rates it TRACK. The AI relevance is weak: CuteNews is a PHP news CMS, not an ML framework, and the AI category assignment looks like a misclassification, so treat it as a conventional web application risk. Check whether any CuteNews instance is deployed, especially on hosts adjacent to ML dashboards or AI content workflows. If one is, restrict Media Manager access, block executable extensions in the upload directory, and monitor for new files there while waiting for an upstream fix.

Sources:NVDEPSSATLASCISA SSVC

What is the risk?

Medium overall. Impact is high (full confidentiality, integrity and availability loss of the web application host) and complexity is low, but the need for a high-privilege authenticated account and the lack of a public exploit, scanner template, or KEV listing keep the likelihood low. EPSS of 0.53% (top 57%) supports a TRACK posture. Risk rises if admin credentials are weak, reused, or exposed, or if the host shares a network with AI/ML infrastructure.

How does the attack unfold?

Initial Access

Attacker logs in to CuteNews with valid high-privilege credentials and opens the Media Manager panel.

AML.T0012

Exploitation

Attacker uploads a dangerous file type such as a PHP web shell through core/modules/media.php without restriction.

AML.T0049

Execution

Attacker requests the uploaded file to execute code and trigger a reverse shell to their infrastructure.

AML.T0072

Impact

Attacker gains remote server access and can steal credentials or pivot to adjacent AI/ML systems.

Initial Access

Attacker logs in to CuteNews with valid high-privilege credentials and opens the Media Manager panel.

AML.T0012

Exploitation

Attacker uploads a dangerous file type such as a PHP web shell through core/modules/media.php without restriction.

AML.T0049

Execution

Attacker requests the uploaded file to execute code and trigger a reverse shell to their infrastructure.

AML.T0072

Impact

Attacker gains remote server access and can steal credentials or pivot to adjacent AI/ML systems.

How severe is it?

CVSS 3.1

7.2 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRHigh

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

6 steps

Inventory CuteNews 2.1.2 deployments and decide whether they can be retired or replaced.
Check the upstream repository and the disclosure repository for a fix and apply it when available.
Restrict Media Manager and admin panel access by IP or VPN, and enforce strong, unique credentials with MFA where possible.
Disable script execution (PHP) in the upload directory via web server configuration and allowlist safe file types and MIME types.
Monitor the upload directory for new .php, .phtml, or other executable files, and watch for outbound connections from the web server that suggest a reverse shell.
Run the web server with least privilege and network egress filtering.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAuth BypassFrameworkAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0072- Reverse Shell

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and manage unknown or emergent risks

Frequently Asked Questions

What is CVE-2026-36467?

CuteNews 2.1.2 has an unrestricted file upload flaw (CWE-434) in its Media Manager that lets an authenticated administrator-level user upload a dangerous file type and run arbitrary code on the server, including a reverse shell. The exposure is limited because it requires high privileges (PR:H), the CVSS score is 7.2, EPSS sits at 0.5% (top 57%), and there is no public exploit, Nuclei template, or CISA KEV listing. CISA SSVC rates it TRACK. The AI relevance is weak: CuteNews is a PHP news CMS, not an ML framework, and the AI category assignment looks like a misclassification, so treat it as a conventional web application risk. Check whether any CuteNews instance is deployed, especially on hosts adjacent to ML dashboards or AI content workflows. If one is, restrict Media Manager access, block executable extensions in the upload directory, and monitor for new files there while waiting for an upstream fix.

Is CVE-2026-36467 actively exploited?

No confirmed active exploitation of CVE-2026-36467 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-36467?

1. Inventory CuteNews 2.1.2 deployments and decide whether they can be retired or replaced. 2. Check the upstream repository and the disclosure repository for a fix and apply it when available. 3. Restrict Media Manager and admin panel access by IP or VPN, and enforce strong, unique credentials with MFA where possible. 4. Disable script execution (PHP) in the upload directory via web server configuration and allowlist safe file types and MIME types. 5. Monitor the upload directory for new .php, .phtml, or other executable files, and watch for outbound connections from the web server that suggest a reverse shell. 6. Run the web server with least privilege and network egress filtering.

What systems are affected by CVE-2026-36467?

This vulnerability affects the following AI/ML architecture patterns: Web content management systems, Web-facing admin dashboards.

What is the CVSS score for CVE-2026-36467?

CVE-2026-36467 has a CVSS v3.1 base score of 7.2 (HIGH). The EPSS exploitation probability is 0.53%.

What is the AI security impact?

Affected AI Architectures

Web content management systemsWeb-facing admin dashboards

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0072Reverse Shell

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell.

Exploitation Scenario

An attacker obtains or guesses administrator-level credentials for a CuteNews site, for example through credential reuse or phishing. They log in, open the Media Manager, and upload a PHP web shell disguised as a media file. They request the uploaded file to trigger a reverse shell back to attacker infrastructure, gaining server access. From there they search the host for API keys, database credentials, or network paths to adjacent systems, which could include ML dashboards or AI service credentials.

Weaknesses (CWE)

CWE-434Unrestricted Upload of File with Dangerous Type

CWE-434 — Unrestricted Upload of File with Dangerous Type: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

[Architecture and Design] Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.[REF-422] [REF-423]
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

Source: MITRE CWE corpus.