VulnerabilityAnalyzed

CVE-2026-35047

Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allows attackers to upload arbitrary files, including executable scripts.

CRITICAL 9.3EPSS 0.55%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.55%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allows attackers to upload arbitrary files, including executable scripts. This may lead to Remote Code Execution (RCE) on the server, potentially resulting in full system compromise, data exfiltration, or service disruption. All users running affected versions of BraveCMS are impacted. This vulnerability is fixed in 2.0.6.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.55% probability · 45th percentile
CISA KEV: Not listed
Weakness: CWE-434
Affected: ajax30/bravecms
Source: security-advisories@github.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.