CVE-2026-35164 Brave CMS Sffected by Unrestricted File Upload via CKEditor Endpoint
Authenticated attackers can upload malicious PHP scripts via CKEditor to achieve remote code execution in Brave CMS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-35164?
CVE-2026-35164 is a high-severity vulnerability in Ajax30 BraveCMS-2.0, published on 6 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Brave CMS is an open-source CMS. Prior to 2.0.6, an unrestricted file upload vulnerability exists in the CKEditor upload functionality. It is found in app/Http/Controllers/Dashboard/CkEditorController.php within the ckupload method. The method fails to validate uploaded file types and relies entirely on user input. This allows an authenticated user to upload executable PHP scripts and gain Remote Code Execution. This vulnerability is fixed in 2.0.6.
Weakness: CWE-434
Which versions are affected by CVE-2026-35164?
It affects 1 product.
Products include Ajax30 Bravecms.
How do I fix CVE-2026-35164?
No fix has been published for CVE-2026-35164 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-35164 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35164 exists.