CVE-2022-26630: Jellycms

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

Jellycms v3.8.1 and below was discovered to contain an arbitrary file upload vulnerability via \app.\admin\Controllers\db.php.

Affected products

• Jellycms Jellycms: up to and including 3.8.1

Published 2022-04-05. Last modified 2026-06-17.