Critical severity9.8NVD Advisory· Published Apr 6, 2026· Updated Apr 10, 2026
CVE-2026-35047
CVE-2026-35047
Description
Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allows attackers to upload arbitrary files, including executable scripts. This may lead to Remote Code Execution (RCE) on the server, potentially resulting in full system compromise, data exfiltration, or service disruption. All users running affected versions of BraveCMS are impacted. This vulnerability is fixed in 2.0.6.
Affected products
1Patches
1058ee4ed7c2bhttps://github.com/Ajax30/BraveCMS-2.0via nvd-ref
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3News mentions
0No linked articles in our index yet.