CVE-2021-25119CWE-434

AGIL <= 1.0 - Admin+ Arbitrary File Upload

published May 16, 2022

CVSS
—
EPSS
1%
Percentile
73.6
In the wild
Unconfirmed
What it is

The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01472 · 73.6th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2022-05-16T14:30Z
EPSS history
Timeline
  • 16 MAY 14:30Z
    AGIL <= 1.0 - Admin+ Arbitrary File Upload
    cvelistv5