CVE-2020-37117

jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitrary files. Attackers can exploit the vulnerability by sending crafted POST requests with malicious filepath and download_url parameters to trigger unauthorized file downloads.

CVSS v4.0

8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.69% chance of exploitation in the next 30 days, 50th percentile

Published

2026-02-05

Updated

2026-03-05

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/48361

References

• CVE Record
• NVD entry

Related

• CVE-2020-37116
• CVE-2020-37118
• CVE-2020-37115
• CVE-2020-37119
• CVE-2020-37114
• CVE-2020-37120