Answer in brief
CVE-2026-109218 records a Critical severity (CVSS 9.8) vulnerability in Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass. The current sources do not mark it as known exploited. The current feed maps kleor/Contact Manager (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps kleor/Contact Manager (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| kleor/Contact Managergeneric | >=0 <=9.1.2 | Not reported |
Published upstream
Oct 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 28, 2026
The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request.
Quoted source text, attributed separately from HOL analysis.