CVE-2020-37073 Victor CMS 1.0 - Authenticated Arbitrary File Upload
Authenticated administrators can upload malicious PHP files to execute arbitrary system commands on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-37073?
CVE-2020-37073 is a high-severity vulnerability in VictorAlagwu CMSsite, published on 3 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Victor CMS 1.0 contains an authenticated file upload vulnerability that allows administrators to upload PHP files with arbitrary content through the user_image parameter. Attackers can upload a malicious PHP shell to the /img/ directory and execute system commands by accessing the uploaded file with a 'cmd' parameter.
Weakness: CWE-434
Which versions are affected by CVE-2020-37073?
It affects 1 product.
Products include Victor Cms Project Victor Cms.
How do I fix CVE-2020-37073?
No fix has been published for CVE-2020-37073 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-37073 being exploited?
There is no known exploitation of CVE-2020-37073 in the wild and no public exploit code.
Other vulnerabilities in VictorAlagwu CMSsite
Sources
Also known as GHSA-pgrm-rf8r-q98p.