GitHub Advisoryadvisory · Packagist

GHSA-vhgr-gfx3-fg37 Unrestricted Upload of File with Dangerous Type in WPanel 4

HIGH Published 2022-04-01 Modified 2022-04-12 Official page ↗
Aliases
CVE-2021-34257
Ecosystem
Packagist
Packages
wpanel/wpanel4-cms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2022-04-12

Affected packages

• Packagist wpanel/wpanel4-cms: <= 4.3.1 (no fix yet)

Description

Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image.

Related

Alias · CVE (1)

  • CVE-2021-34257 Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References