GitHub Advisoryadvisory · Packagist

GHSA-c442-3278-rhrg Unrestricted File Upload in ShowDoc v2.9.5

CRITICAL Published 2021-09-09 Modified 2021-09-16 Official page ↗
Aliases
CVE-2021-36440
Ecosystem
Packagist
Packages
showdoc/showdoc
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2021-09-09

Affected packages

• Packagist showdoc/showdoc: < 2.9.6 → fixed in 2.9.6

Description

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.

Related

Alias · CVE (1)

  • CVE-2021-36440 Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References