CVE-2015-5457

PivotX before 2.3.11 does not validate the new file extension when renaming a file with multiple extensions, which allows remote attackers to execute arbitrary…

published July 8, 2015

CVSS
—
EPSS
5%
Percentile
91.6
In the wild
Unconfirmed
What it is

PivotX before 2.3.11 does not validate the new file extension when renaming a file with multiple extensions, which allows remote attackers to execute arbitrary code by uploading a crafted file, as demonstrated by a file named foo.php.php.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04647 · 91.6th percentile
Published
2015-07-08T15:00Z
EPSS history
Timeline
  • 08 JUL 15:00Z
    PivotX before 2.3.11 does not validate the new file extension when renaming a file with multiple extensions, which allows remote attackers to execute arbitrary…
    cvelistv5