{"id":"CVE-2026-86666","title":"A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15","summary":"A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_json/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remot…","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":["CWE-284","CWE-434"],"vendor":"aircheng-org","product":"iWebShop-5","affected":["iWebShop-5 5.0","iWebShop-5 5.1","iWebShop-5 5.2","iWebShop-5 5.3","iWebShop-5 5.4","iWebShop-5 5.5","iWebShop-5 5.6","iWebShop-5 5.7","iWebShop-5 5.8","iWebShop-5 5.9","iWebShop-5 5.10","iWebShop-5 5.11","iWebShop-5 5.12","iWebShop-5 5.13","iWebShop-5 5.14","iWebShop-5 5.15"],"published":"2026-09-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T14:17:09.520","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86666","references":[{"url":"https://github.com/aircheng-org/iWebShop-5/","label":"cna@vuldb.com"},{"url":"https://github.com/aircheng-org/iWebShop-5/issues/3","label":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-86666","label":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908924","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/399757","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/399757/cti","label":"cna@vuldb.com"},{"url":"https://github.com/aircheng-org/iWebShop-5/issues/3","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-10T13:57:17.184811Z"},"epss":0.00538,"epssPercentile":0.42923,"ingestedAt":"2026-09-08T16:34:19.228Z","slug":"CVE-2026-86666","body":"## Overview\n\nA security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_json/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":40.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":202147,"id":"CVE-2026-86666","ts":1789400063900,"field":"exploit_available","old":"false","new":"true"},{"seq":200874,"id":"CVE-2026-86666","ts":1789397617779,"field":"exploit_available","old":"true","new":"false"},{"seq":199567,"id":"CVE-2026-86666","ts":1789395538117,"field":"exploit_available","old":"false","new":"true"},{"seq":198812,"id":"CVE-2026-86666","ts":1789392245685,"field":"exploit_available","old":"true","new":"false"},{"seq":197145,"id":"CVE-2026-86666","ts":1789384295079,"field":"exploit_available","old":"false","new":"true"},{"seq":196419,"id":"CVE-2026-86666","ts":1789383757366,"field":"exploit_available","old":"true","new":"false"},{"seq":195323,"id":"CVE-2026-86666","ts":1789380575773,"field":"exploit_available","old":"false","new":"true"},{"seq":194274,"id":"CVE-2026-86666","ts":1789378784396,"field":"exploit_available","old":"true","new":"false"},{"seq":193061,"id":"CVE-2026-86666","ts":1789376518944,"field":"exploit_available","old":"false","new":"true"},{"seq":191848,"id":"CVE-2026-86666","ts":1789373632474,"field":"exploit_available","old":"true","new":"false"},{"seq":190633,"id":"CVE-2026-86666","ts":1789369485225,"field":"exploit_available","old":"false","new":"true"},{"seq":189420,"id":"CVE-2026-86666","ts":1789368441851,"field":"exploit_available","old":"true","new":"false"},{"seq":188203,"id":"CVE-2026-86666","ts":1789365234918,"field":"exploit_available","old":"false","new":"true"},{"seq":186990,"id":"CVE-2026-86666","ts":1789363472629,"field":"exploit_available","old":"true","new":"false"},{"seq":185776,"id":"CVE-2026-86666","ts":1789361233550,"field":"exploit_available","old":"false","new":"true"},{"seq":184563,"id":"CVE-2026-86666","ts":1789358365236,"field":"exploit_available","old":"true","new":"false"},{"seq":182813,"id":"CVE-2026-86666","ts":1789354318529,"field":"exploit_available","old":"false","new":"true"},{"seq":181606,"id":"CVE-2026-86666","ts":1789353319076,"field":"exploit_available","old":"true","new":"false"},{"seq":180399,"id":"CVE-2026-86666","ts":1789350286128,"field":"exploit_available","old":"false","new":"true"},{"seq":179192,"id":"CVE-2026-86666","ts":1789348294269,"field":"exploit_available","old":"true","new":"false"},{"seq":177985,"id":"CVE-2026-86666","ts":1789346371734,"field":"exploit_available","old":"false","new":"true"},{"seq":176778,"id":"CVE-2026-86666","ts":1789343185854,"field":"exploit_available","old":"true","new":"false"},{"seq":174895,"id":"CVE-2026-86666","ts":1789334877017,"field":"exploit_available","old":"false","new":"true"},{"seq":173690,"id":"CVE-2026-86666","ts":1789333702156,"field":"exploit_available","old":"true","new":"false"},{"seq":172504,"id":"CVE-2026-86666","ts":1789331094415,"field":"exploit_available","old":"false","new":"true"},{"seq":171318,"id":"CVE-2026-86666","ts":1789328782236,"field":"exploit_available","old":"true","new":"false"},{"seq":170113,"id":"CVE-2026-86666","ts":1789327198502,"field":"exploit_available","old":"false","new":"true"},{"seq":168908,"id":"CVE-2026-86666","ts":1789323841597,"field":"exploit_available","old":"true","new":"false"},{"seq":167703,"id":"CVE-2026-86666","ts":1789319704157,"field":"exploit_available","old":"false","new":"true"},{"seq":166498,"id":"CVE-2026-86666","ts":1789318777524,"field":"exploit_available","old":"true","new":"false"},{"seq":165293,"id":"CVE-2026-86666","ts":1789315805445,"field":"exploit_available","old":"false","new":"true"},{"seq":164088,"id":"CVE-2026-86666","ts":1789313635601,"field":"exploit_available","old":"true","new":"false"},{"seq":162883,"id":"CVE-2026-86666","ts":1789311904859,"field":"exploit_available","old":"false","new":"true"},{"seq":161678,"id":"CVE-2026-86666","ts":1789308734528,"field":"exploit_available","old":"true","new":"false"},{"seq":159791,"id":"CVE-2026-86666","ts":1789300471881,"field":"exploit_available","old":"false","new":"true"},{"seq":156780,"id":"CVE-2026-86666","ts":1789294757084,"field":"exploit_available","old":"true","new":"false"},{"seq":155575,"id":"CVE-2026-86666","ts":1789292969276,"field":"exploit_available","old":"false","new":"true"},{"seq":154370,"id":"CVE-2026-86666","ts":1789289798927,"field":"exploit_available","old":"true","new":"false"},{"seq":151621,"id":"CVE-2026-86666","ts":1789277631149,"field":"exploit_available","old":"false","new":"true"},{"seq":150582,"id":"CVE-2026-86666","ts":1789276255432,"field":"exploit_available","old":"true","new":"false"},{"seq":149549,"id":"CVE-2026-86666","ts":1789273826073,"field":"exploit_available","old":"false","new":"true"},{"seq":148516,"id":"CVE-2026-86666","ts":1789271350815,"field":"exploit_available","old":"true","new":"false"},{"seq":146547,"id":"CVE-2026-86666","ts":1789269400528,"field":"exploit_available","old":"false","new":"true"},{"seq":145352,"id":"CVE-2026-86666","ts":1789266341604,"field":"exploit_available","old":"true","new":"false"},{"seq":144256,"id":"CVE-2026-86666","ts":1789262618012,"field":"exploit_available","old":"false","new":"true"},{"seq":143160,"id":"CVE-2026-86666","ts":1789261534802,"field":"exploit_available","old":"true","new":"false"},{"seq":141991,"id":"CVE-2026-86666","ts":1789258836745,"field":"exploit_available","old":"false","new":"true"},{"seq":140832,"id":"CVE-2026-86666","ts":1789256728439,"field":"exploit_available","old":"true","new":"false"},{"seq":139634,"id":"CVE-2026-86666","ts":1789254833394,"field":"exploit_available","old":"false","new":"true"},{"seq":138436,"id":"CVE-2026-86666","ts":1789251935532,"field":"exploit_available","old":"true","new":"false"}]}