PT-2026-30686 · Brave Cms · Brave Cms

Ajax30 · CVE-2026-35047 · Published 2026-04-06 · Updated 2026-04-06

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Brave CMS versions prior to 2.0.6

Description A flaw exists in Brave CMS that allows attackers to upload arbitrary files through the CKEditor endpoint. Successful exploitation of this issue could lead to Remote Code Execution (RCE), potentially resulting in full system compromise, data exfiltration, or service disruption. All users running affected versions of BraveCMS are impacted.

Recommendations Update to version 2.0.6 or later.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-35047

GHSA-9RCC-W59J-965V

Affected Products

Brave Cms

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35047.json · Exploit
• https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-9rcc-w59j-965v · Vendor Advisory
• https://github.com/Ajax30/BraveCMS-2.0/commit/058ee4ed7c2b39d540af8274024afcbc9532aa83 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35047 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35047 · Vendor Advisory
• https://github.com/Ajax30/BraveCMS-2.0/pull/122 · Note
• https://twitter.com/0dayPublishing/status/2041209193877721309 · Twitter Post
• https://twitter.com/CVEnew/status/2041223956829450338 · Twitter Post