Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allows attackers to upload arbitrary files, including executable scripts. This may lead to Remote Code Execution (RCE) on the server, potentially resulting in full system compromise, data exfiltration, or service disruption. All users running affected versions of BraveCMS are impacted. This vulnerability is fixed in 2.0.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35047 Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allows attackers to upload arbitrary files, includ… https://www.cve.org/CVERecord?id=CVE-2026-35047
Post summary
The text announces an unrestricted file upload vulnerability in Brave CMS prior to 2.0.6, providing technical details but no evidence of exploitation, PoC, or remediation.
🚨 CVE-2026-35047: Brave CMS has Unrestricted File ... CKEditor file upload bypass = instant shell access with zero auth required - classic WYSIWYG editor fail that screams m... https://zerodaysignal.com/vulnerability/CVE-2026-35047 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE-2026-35047, highlighting an unrestricted CKEditor file‑upload bug in Brave CMS that permits shell access with no authentication, but it does not detail patches or active exploitation evidence.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ajax30 | bravecms | - | - | - |