CVE-2026-18143

Summary

The flaw allows unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary directory, leading to Remote Code Execution (RCE).

Exploitability

Exploitation is relatively easy as it requires enabling a public quote rule with the multi-page popup flow and uploading a file with a valid filename but an executable payload.

Blast radius

If exploited, the impact could be severe, as it allows attackers to execute arbitrary code on the server, potentially leading to full server compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected feature or upgrade to version 3.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.