CVE-2024-58283

WBCE CMS 1.6.2 Remote Code Execution via Elfinder File Upload

WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a user-controlled parameter.

Affected

wbce · WBCE CMS

CVSS v4.0 VULNCHECK

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.66% chance of exploitation in the next 30 days, 51st percentile

Published

2025-12-10

Updated

2026-04-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/52039

Security advisories

• https://www.vulncheck.com/advisories/wbce-cms-remote-code-execution-via-elfinder-file-upl…
• WBCE/WBCE_CMS/archive/refs/tags/1.6.2.zip
• https://wbce-cms.org

References

• CVE Record
• NVD entry