Read the docs
TI-2026-27250 Aliases CVE-2026-35047

Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint

Priority MEDIUM 49CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allows attackers to upload arbitrary files, including executable scripts. This may lead to Remote Code Execution (RCE) on the server, potentially resulting in full system compromise, data exfiltration, or service disruption. All users running affected versions of BraveCMS are impacted. This vulnerability is fixed in 2.0.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00564 47th percentileScored 2026-11-07
Fix Fixed BraveCMS-2.0 (Ajax30): 2.0.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Ajax30BraveCMS-2.0before 2.0.62.0.6Patch availableCNA
  • BraveCMS-2.0 VendorAjax30 Affected before 2.0.6 Fixed in 2.0.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ajax30:bravecms:*:*:*:*:*:*:*:*2.0.0 to before 2.0.6VulnerableAjax30
  • cpe:2.3:a:ajax30:bravecms:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.0.6 Vulnerable ·Ajax30

Remediation

  • Fix · CNA BraveCMS-2.0 (Ajax30) Fixed in 2.0.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35047
  2. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 1

Advisory 1

Other 1

  • TI-2026-27336 Missing authorization privilege escalation in Ajax30 BraveCMS-2.0 CVSS 3.1HIGH 8.8
  • TI-2026-27318 Brave CMS Sffected by Unrestricted File Upload via CKEditor Endpoint CVSS 3.1HIGH 8.8
  • TI-2026-27337 Brave CMS has an Insecure Direct Object Reference in Article Image Deletion CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences