liufee/cms · Security
Feehi CMS arbitrary file upload vulnerability
- GHSA ID
- GHSA-65x8-9vgm-5fg5
- CVE ID
- CVE-2020-22643
- Severity
- high
- Published
- Updated
- CVSS
- 7.2 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 7.2 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
Feehi CMS 2.1.0-beta is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution. After an administrator logs in, open the administrator image upload page to potentially upload malicious files.
CWEs
- CWE-434 · Unrestricted Upload of File with Dangerous Type