by Kastro
Paper/Archive/CVE-2026-35047

CVE-2026-35047

Ajax30 BraveCMS-2.0 — Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 46.2.462 × 209.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allows attackers to upload arbitrary files, including executable scripts. This may lead to Remote Code Execution (RCE) on the server, potentially resulting in full system compromise, data exfiltration, or service disruption. All users running affected versions of BraveCMS are impacted. This vulnerability is fixed in 2.0.6.

Affected

ProductAffectedFixed inSource
BraveCMS-2.0< 2.0.6–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-9rcc-w59j-965vrefgithub.com/Ajax30/BraveCMS-2.0/pull/122refgithub.com/Ajax30/BraveCMS-2.0/commit/058ee4ed7c2b39d540af8274024afcbc9532aa83