CVE-2019-17536

Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php

Critical · published October 13, 2019

CVSS v3.0
9.9
EPSS
2%
Percentile
82.8
In the wild
Unconfirmed
What it is

Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move.

The record
Technical detail
CVSS v3.0
9.9 · CRITICAL
Vector
CVSS:3.0/AC:L/AV:N/A:L/C:H/I:H/PR:L/S:C/UI:N
CVSS v4.0
Not supplied
EPSS
0.02254 · 82.8th percentile
Published
2019-10-13T17:52Z
EPSS history
Timeline
  • 13 OCT 17:52Z
    Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php
    cvelistv5