GitHub Advisoryadvisory · Packagist

GHSA-65x8-9vgm-5fg5 Feehi CMS arbitrary file upload vulnerability

HIGH Published 2022-05-24 Modified 2023-07-07 Official page ↗
Aliases
CVE-2020-22643
Ecosystem
Packagist
Packages
feehi/cms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2023-07-07

Affected packages

• Packagist feehi/cms: <= 2.1.0-beta (no fix yet)

Description

Feehi CMS 2.1.0-beta is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution. After an administrator logs in, open the administrator image upload page to potentially upload malicious files.

Related

Alias · CVE (1)

  • CVE-2020-22643 Feehi CMS 2.1.0 is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References