CVE-2021-47753 phpKF CMS 3.00 Beta y6 - Remote Code Execution (RCE) (Unauthenticated)
Unauthenticated attackers can upload malicious PHP files disguised as images to execute arbitrary code on phpKF CMS installations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47753?
CVE-2021-47753 is a critical vulnerability in phpKF CMS, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
phpKF CMS 3.00 Beta y6 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary code by bypassing file extension checks. Attackers can upload a PHP file disguised as a PNG, rename it, and execute system commands through a crafted web shell parameter.
Weakness: CWE-434
Which versions are affected by CVE-2021-47753?
It affects 1 product.
Products include Phpkf Cms.
How do I fix CVE-2021-47753?
No fix has been published for CVE-2021-47753 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-47753 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47753 exists.
Sources
Also known as GHSA-q6vq-8ww2-4v69.