GHSA-65x8-9vgm-5fg5

Feehi CMS arbitrary file upload vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2020-22643

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	feehi/cms	<= 2.1.0-beta	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Feehi CMS 2.1.0-beta is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution. After an administrator logs in, open the administrator image upload page to potentially upload malicious files.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-22643 advisory
https://github.com/liufee/cms/issues/51 web
https://github.com/liufee/cms package