GHSA-77j2-7whr-6vpx
Elefant CMS Code Execution Vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | elefant/cms | < 2.0.7 | 2.0.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in `apps/filemanager/upload/drop.php` by using `/filemanager/api/rm/.htaccess` to remove the .htaccess file, and then using a filename that ends in .php followed by space characters (for bypassing the blacklist).
References
External links from the advisory. They lead to third-party sites.