What is GHSA-2j38-m62m-3qch?

GHSA-2j38-m62m-3qch is a security advisory published by GitHub Security Advisories with High severity. Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2...

Which CVE IDs does GHSA-2j38-m62m-3qch cover?

GHSA-2j38-m62m-3qch covers the following CVE IDs: CVE-2026-36467. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2j38-m62m-3qch?

GHSA-2j38-m62m-3qch has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-2j38-m62m-3qchHighCVSS 7.2

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2...

Vendor

GitHub Security Advisories

Published

September 21, 2026

Last Modified

September 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-36467 →

📋 Description

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-36467
https://github.com/CuteNews/cutenews-2.0
https://github.com/CuteNews/cutenews-2.0/blob/master/core/modules/media.php
https://github.com/UmbraDeorum/cutenews-2.0-CVEs-2026-Disclosure
https://github.com/advisories/GHSA-2j38-m62m-3qch