CVE-2020-14067 File upload in n/a

Critical 9.8 Published 15 Jun 2020 Updated 4 Aug 2024

Attacker can upload malicious PHP files disguised as .phtml in ZIP archives to execute arbitrary code on the server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-14067?

CVE-2020-14067 is a critical vulnerability in n/a, published on 15 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The install_from_hash functionality in Navigate CMS 2.9 does not consider the .phtml extension when examining files within a ZIP archive that may contain PHP code, in check_upload in lib/packages/extensions/extension.class.php and lib/packages/themes/theme.class.php.

Weakness: CWE-434

Which versions are affected by CVE-2020-14067?

It affects 1 product.

Products include Naviwebs Navigatecms.

How do I fix CVE-2020-14067?

No fix has been published for CVE-2020-14067 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-14067 being exploited?

There is no known exploitation of CVE-2020-14067 in the wild and no public exploit code.

Sources

Also known as GHSA-r6q3-9w45-pp9p.