CVE-2020-26048 - CVE House
Back to Database
Status published High CVE-2020-26048

The file manager option in CuppaCMS before 2019-11-12 allows an...

Vulnerability Description

The file manager option in CuppaCMS before 2019-11-12 allows an authenticated attacker to upload a malicious file within an image extension and through a custom request using the rename function provided by the file manager is able to modify the image extension into PHP resulting in remote arbitrary code execution.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-26048

Credits & Attribution

No credits recorded in the NVD database.

References

More from cuppacms

View All →
CVE-2022-38296
Cuppa CMS v1.0 was discovered to contain an arbitrary file...
Critical 9.8
CVE-2022-38295
Cuppa CMS v1.0 was discovered to contain a cross-site scripting...
Medium 6.1
CVE-2022-37191
The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI....
Medium 6.5
CVE-2022-37190
CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An...
High 8.8
CVE-2022-34121
Cuppa CMS v1.0 was discovered to contain a local file...
High 7.5

Affected Vendor

Affected Software

cuppacms
Vulnerable Versions:
0

Timeline

Official Publish: October 5th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.