GHSA-x2w2-qgv6-8xrm
Elefant CMS PHP Code Execution Vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | elefant/cms | < 2.0.7 | 2.0.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in `/designer/add/stylesheet.php` by using a `.php` extension in the New Stylesheet Name field in conjunction with `<?php` content, because of insufficient input validation in `apps/designer/handlers/csspreview.php`.
References
External links from the advisory. They lead to third-party sites.