CVE-2026-35164

Brave CMS is an open-source CMS. Prior to 2.0.6, an unrestricted file upload vulnerability exists in the CKEditor upload functionality. It is found in app/Http/Controllers/Dashboard/CkEditorController.php within the ckupload method. The method fails to validate uploaded file types and relies entirely on user input. This allows an authenticated user to upload executable PHP scripts and gain Remote Code Execution. This vulnerability is fixed in 2.0.6.

• CWE-434

• https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-2j4q-6p52-4rhwExploit, Vendor Advisory
• https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-2j4q-6p52-4rhwExploit, Vendor Advisory

Published

Apr 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35157Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectSca…9.8
• CVE-2026-35159Dell Client Platform BIOS contains an Authentication Bypass …5.3
• CVE-2026-3516The Contact List plugin for WordPress is vulnerable to Store…6.4
• CVE-2026-35160Dell SmartFabric OS10 Software, versions prior to 10.5.6.14,…5
• CVE-2026-35162Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain…6.5
• CVE-2026-35163OctoPrint provides a web interface for controlling consumer …4.6
• CVE-2026-35165LORIS (Longitudinal Online Research and Imaging System) is a…6.5
• CVE-2026-35166Hugo is a static site generator. From 0.60.0 to before 0.159…5.4
• CVE-2026-35167Kedro is a toolbox for production-ready data science. Prior …8.1
• CVE-2026-35168OpenSTAManager is an open source management software for tec…8.8
• CVE-2026-35169LORIS (Longitudinal Online Research and Imaging System) is a…5.4
• CVE-2026-3517OS Command Injection Remote Code Execution Vulnerability in …7.2