Arbitrary File Upload

Overview area17/twill is an open-source CMS toolkit for Laravel that helps developers rapidly create a custom admin console that is intuitive, powerful, and flexible. Affected versions of this package are vulnerable to Arbitrary File Upload via the storeFile function in the Media Library Insert...

EUVD-2026-43260

A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Admin/FileLibraryController.php of the component Media Library Insert Page. Such manipulation of the argument qqfilename leads to...