CVE-2023-26852

Deeper analysis

CVE-2023-26852 is an arbitrary file upload vulnerability affecting the upload plugin in Textpattern versions 4.8.8 and earlier. The flaw, classified under CWE-434, permits an authenticated user to upload a crafted PHP file that can subsequently be executed on the server, leading to arbitrary code execution. The issue carries a CVSS 3.1 base score of 7.2, reflecting network attack vector, low complexity, and high impact on confidentiality, integrity, and availability when the required privileges are present.

An attacker with administrative or other high-privileged credentials can exploit the vulnerability remotely by uploading a malicious PHP payload through the affected plugin interface. Successful exploitation grants the ability to run arbitrary code on the underlying web server, potentially resulting in full system compromise, data exfiltration, or persistence within the Textpattern installation.

Public references include a proof-of-concept repository and the upstream Textpattern project page, but no vendor advisory or patch details are provided in the available sources. The CVE’s EPSS score has remained near 0.17 with only minimal fluctuation between its current and peak values, indicating moderate but stable exploitation interest rather than a sharp post-disclosure increase.