PT-2026-29786 · Unknown · Textpattern

Zsmaaa · Published 2026-04-02 · Updated 2026-04-02 · CVE-2026-5344

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Textpattern versions prior to 4.9.2

Description A security issue exists in Textpattern up to version 4.9.1. The mt uploadImage function within the rpc/TXP RPCServer.php file, part of the XML-RPC Handler component, is susceptible to path traversal due to manipulation of the file.name argument. This allows for remote exploitation. The details of the exploit have been publicly disclosed.

Recommendations Update to version 4.9.2 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-5344

Affected Products

Textpattern

References · 6

• 🔥 https://github.com/LTX-GOD/Mycve/blob/main/Textpatterncms_en.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5344 · Security Note
• https://vuldb.com/vuln/354696 · Note
• https://twitter.com/CVEnew/status/2039744328877137980 · Twitter Post
• https://vuldb.com/vuln/354696/cti · Note
• https://vuldb.com/submit/769166 · Note