CVE-2026-112027 light0011 CVE debrief

Who should care

Defenders responsible for light0011 cms deployments should assess exposure and prioritize verification of the vulnerability in their inventory. This includes operators, platform administrators, vulnerability management teams, and security teams who need to identify and mitigate potential risks associated with the Uploadify component. They should review the vulnerability details, assess the impact on their systems, and plan for necessary updates or mitig

Why it matters

Defenders should prioritize verifying the vulnerability in their inventory and assessing exposure, as the exploit is public and may be used.

• File and directory information exposure may allow attackers to gather information about the system.
• The public exploit may be used to launch remote attacks.
• Defenders should verify the vulnerability in their inventory and assess exposure.

Technical summary

The vulnerability affects the function file_exists in the file Public/Home/js/uploadify/check-exists.php of the Uploadify component in light0011 cms. The manipulation of the argument filename results in file and directory information exposure. This issue allows remote attackers to gather information about the system, potentially aiding in further exploitation. Defenders should prioritize verifying the vulnerability in their inventory and assessing exposure, as the exploit is public and may be used. The affected product deployments should be identified, and owners assigned for follow-up.

Defensive priority

Defenders should prioritize verifying the vulnerability in their inventory and assessing exposure, as the exploit is public and may be used.

Recommended defensive actions

• Verify the vulnerability in your inventory
• Assess exposure of the Uploadify component
• Restrict access to the check-exists.php file
• Monitor for potential exploitation attempts
• Apply vendor patches or updates
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability was detected in light0011 cms versions c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930. The function file_exists in the file Public/Home/js/uploadify/check-exists.php is affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.