CVE-2020-36070 Remote code execution in Voyager

What is CVE-2020-36070?

CVE-2020-36070 is a critical vulnerability in n/a, published on 26 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Insecure Permission vulnerability found in Yoyager v.1.4 and before allows a remote attacker to execute arbitrary code via a crafted .php file to the media component.

Weakness: CWE-281

Which versions are affected by CVE-2020-36070?

2 open source packages ship an affected version, including tcg/voyager. It affects 1 product.

Products include Thecontrolgroup Voyager.

How do I fix CVE-2020-36070?

No fix has been published for CVE-2020-36070 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-36070 being exploited?

There is no known exploitation of CVE-2020-36070 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2019-17050 Path traversal in n/a High 7.2
• CVE-2024-55415 DevDojo Voyager vulnerable to path traversal Medium 5.7
• CVE-2024-55417 DevDojo Voyager Arbitrary File Write Medium 4.3
• CVE-2024-55416 DevDojo Voyager vulnerable to reflected Cross-site Scripting Low 3.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2x3r-7jgm-gh8x.