CVE-2020-5514

Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI.

CVSS v3.1

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

44.11% chance of exploitation in the next 30 days, 99th percentile

Published

2020-01-06

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://infosecdb.wordpress.com/2020/01/05/gilacms-1-11-8-remote-code-execution/

References

• CVE Record
• NVD entry

Related

• CVE-2020-5513
• CVE-2020-5515
• CVE-2020-5511
• CVE-2020-5720
• CVE-2020-5510
• CVE-2020-5722