CVE-2026-35047 is a critical unrestricted file upload in Brave CMS, an open source CMS. NVD scores it 9.8. The CKEditor upload endpoint accepts executable files and can lead to remote code execution. Upgrade to Brave CMS 2.0.6 or later. Patch first, then check upload folders for files that should not be there.
What's affected
Brave CMS before 2.0.6. The fixed release is 2.0.6.
The record says all users running affected versions are impacted. The flaw is in the CKEditor upload endpoint.
How to check if you're exposed
Check your Brave CMS version in the project files or the release you deployed. Then look in your upload directories for files that are not images or documents, such as script files.
Review web server logs for requests to the editor upload endpoint from addresses that are not your staff.
What to do now
- Upgrade Brave CMS to 2.0.6 or later and redeploy.
- Block script execution in upload directories at the web server level.
- Remove any unexpected executable files from upload folders and investigate how they arrived.
- Restrict the upload endpoint to signed in staff while you patch.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. If a server accepts any file and stores it where the web server runs scripts, a visitor can add code that the server then runs.
The defense has layers: check the file type on the server, rename files, store uploads outside the web root or set them to never execute, and require authentication for the endpoint.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Upload endpoints sit on the edge of every CMS, and editors like CKEditor add routes that administrators forget about. List every endpoint that accepts files, confirm each requires authentication, and confirm uploads cannot run as code. Those two checks catch this whole class of bug, whatever the product.
Quick check
Do I need to reinstall if I find a suspicious file?
Treat it as a compromise. Rebuild from a clean source, rotate credentials, and review what the web user could reach.
Sources
Last reviewed: 19 October 2026.
