Medium
aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload
Type: advisorySources: OSV
A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_json/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-86666
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 08:42 UTC · Revision 1
Source evidence
aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload
core-osv · Original sourcePublished 8 Sept 2026, 16:00 UTC
A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_json/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
osv:CVE-2026-86666
Complete source record
{
"id": "ed6d8b60cc2fd939f6046a288128a83832ca2d6e76f22516f589b526955095a3",
"url": "https://osv.dev/vulnerability/CVE-2026-86666",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload",
"summary": "A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_json/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.",
"evidence": "osv:CVE-2026-86666",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-86666",
"aliases": [
"CVE-2026-86666"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/aircheng-org/iwebshop-5",
"type": "GIT",
"events": [
{
"introduced": "265c1cf536fc17cce6c70ae9c26992b516ba8a30"
},
{
"last_affected": "3bdd7ce934d6d253b59a7131b6fe930af7f77382"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "5.11"
},
{
"last_affected": "5.11"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.12"
},
{
"last_affected": "5.12"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.13"
},
{
"last_affected": "5.13"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.14"
},
{
"last_affected": "5.14"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.15"
},
{
"last_affected": "5.15"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5"
},
{
"last_affected": "5.15"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"5.11",
"5.12",
"5.13",
"5.14",
"5.15",
"v5.15",
"v5.14",
"v5.13",
"v5.12",
"v5.11"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86666.json"
}
}
],
"modified": "2026-10-28T02:30:27.085868951Z",
"provider": "osv",
"references": [
"https://github.com/aircheng-org/iWebShop-5/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86666.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-86666",
"https://vuldb.com/cve/CVE-2026-86666",
"https://vuldb.com/submit/908924",
"https://vuldb.com/vuln/399757",
"https://github.com/aircheng-org/iWebShop-5/issues/3",
"https://vuldb.com/vuln/399757/cti"
],
"provider_metadata": {
"cwe_ids": [
"CWE-284",
"CWE-434"
],
"cna_assigner": "VulDB",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "5.0"
},
{
"last_affected": "5.0"
},
{
"introduced": "5.1"
},
{
"last_affected": "5.1"
},
{
"introduced": "5.2"
},
{
"last_affected": "5.2"
},
{
"introduced": "5.3"
},
{
"last_affected": "5.3"
},
{
"introduced": "5.4"
},
{
"last_affected": "5.4"
},
{
"introduced": "5.5"
},
{
"last_affected": "5.5"
},
{
"introduced": "5.6"
},
{
"last_affected": "5.6"
},
{
"introduced": "5.7"
},
{
"last_affected": "5.7"
},
{
"introduced": "5.8"
},
{
"last_affected": "5.8"
},
{
"introduced": "5.9"
},
{
"last_affected": "5.9"
},
{
"introduced": "5.10"
},
{
"last_affected": "5.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86666.json"
}
},
"related_cves": [
{
"value": "CVE-2026-86666",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 493901,
"published_at": "2026-09-08T16:00:08.475+00:00"
}