GHSA-77j2-7whr-6vpxCriticalCVSS 9.8

Elefant CMS Code Execution Vulnerability

Published
May 14, 2022
Last Modified
July 25, 2023

🔗 CVE IDs covered (1)

CVE-2018-16974 →

📋 Description

An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by space characters (for bypassing the blacklist).

🎯 Affected products1

  • composer/elefant/cms:< 2.0.7

🔗 References (5)