---
id: "CVE-2014-125138"
kind: "vulnerability"
aliases: ["CVE-2014-125138"]
title: "qEngine CMS, Kemana Directory, Cart Engine: editors can upload PHP and run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["cms", "other", "php", "self-hosted"]
not_affected_if: ["product-not-installed"]
published_at: "2026-10-28T03:17:08+00:00"
first_seen_at: "2026-10-28T03:31:01+00:00"
updated_at: "2026-10-28T03:32:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-125138", "first_seen_at": "2026-10-28T03:31:01+00:00"}]
---

# qEngine CMS, Kemana Directory, Cart Engine: editors can upload PHP and run code

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6 and Cart Engine through 3.0.0 accept unrestricted file uploads in administrative image fields. An editor-role user can upload a PHP script to the web-accessible /public/image directory and request it to run code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the product in your stack: qEngine CMS, Kemana Directory or Cart Engine, and note the installed version.
- Check whether `/public/image` is web-accessible and contains any `.php` files.
- Review which accounts hold the editor role.

## Fix

- unknown

## Timeline

- 2026-10-28T03:31:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2014-125138

## From the sources

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_