iniivan13/cve-2026-1107Nuclei template for detecting CVE-2026-1107 in EyouCMS, exploiting path traversal in check_userinfo to read arbitrary files and potentially achieve code execution.
Nuclei template for detecting CVE-2026-1107 in EyouCMS.
The vulnerability allows unauthenticated attackers to perform Path Traversal/Arbitrary File Read via the check_userinfo function in Diyajax.php.
Diyajax.php)POST /index.php?m=api&c=Diyajax&a=check_userinfo (Parameter: viewfile)This template uses a High-Fidelity detection method. Instead of guessing configuration files (which may vary by OS or installation), it attempts to read the source code of the root file using the traversal payload .
index.php../../index.phpIf the server responds with raw PHP tags (<?php, define('APP_PATH'), the target is confirmed vulnerable.
nuclei -t CVE-2026-1107.yaml -u [https://target.com](https://target.com)