CVE-2020-37186 Chevereto 3.13.4 Core - Remote Code Execution
Attackers can achieve remote code execution by injecting malicious PHP code via the database table prefix parameter during installation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-37186?
CVE-2020-37186 is a critical code injection vulnerability in Chevereto, published on 11 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Chevereto 3.13.4 Core contains a remote code execution vulnerability that allows attackers to inject malicious code during database configuration installation. Attackers can manipulate the database table prefix parameter to write a PHP shell file and execute arbitrary system commands through a crafted POST request.
Weakness: CWE-94
Which versions are affected by CVE-2020-37186?
How do I fix CVE-2020-37186?
No fix has been published for CVE-2020-37186 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-37186 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-37186 exists.
Sources
Also known as GHSA-jxfc-7j9j-8gg7.