CVE-2026-2666: mingSoft MCMS Unrestricted File Upload Vulnerability
Summary
CVE-2026-2666: mingSoft MCMS does not properly restrict file uploads. Affects net.mingsoft:ms-mcms versions < 6.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mingSoft MCMS is a content management system designed for building and managing websites. It provides features such as template management, content publishing, and user management. However, version 6.1.1 of mingSoft MCMS has a critical vulnerability that allows for unrestricted file uploads, posing a significant security risk.
Vulnerability Detail
A flaw exists in mingSoft MCMS 6.1.1, specifically in the file upload functionality located at /ms/file/uploadTemplate.do. This vulnerability arises from improper restrictions on file uploads, allowing an attacker to upload malicious files remotely. The consequences of this vulnerability can include unauthorized access to the server, data breaches, and potential exploitation of the server for further attacks. The vulnerability is classified under CWE-284, indicating a violation of access control.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, restrict access to the uploadTemplate.do endpoint by implementing server-side access controls or firewall rules to limit access to trusted IP addresses only.
Conclusion
The mingSoft MCMS vulnerability (CVE-2026-2666) presents a significant risk due to unrestricted file uploads. Users are urged to update to the latest version to mitigate this risk and consider implementing temporary workarounds until the update can be applied.
See every vulnerability recorded for net.mingsoft:ms-mcms →
FAQ
The vulnerability allows for unrestricted file uploads, which can lead to unauthorized access and potential exploitation of the server.
The vulnerability affects mingSoft MCMS version 6.1.1 and earlier.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score of this vulnerability is 4.7, indicating a medium severity level.
If immediate updates are not possible, implement access controls or firewall rules to restrict access to the vulnerable endpoint as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for net.mingsoft:ms-mcms.
