CVE-2020-36079 - CVE House
Back to Database
Status published High CVE-2020-36079

Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload,...

Vulnerability Description

Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop files into the Files(elFinder) portion of the UI. This can, for example, place a .php file in the server's uploaded/ directory. NOTE: the vendor disputes this because exploitation can only be performed by an admin who has "lots of other possibilities to harm a site.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-36079

Credits & Attribution

No credits recorded in the NVD database.

References

More from zenphoto

View All →
CVE-2018-20140
Zenphoto 1.4.14 has multiple cross-site scripting (XSS) vulnerabilities via different...
Medium 6.1
CVE-2015-5595
Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before...
Medium 6.5
CVE-2015-5594
The sanitize_string function in ZenPhoto before 1.4.9 utilized the html_entity_decode...
Medium 6.1
CVE-2015-5593
The sanitize_string function in Zenphoto before 1.4.9 does not properly...
Medium 6.1
CVE-2015-5592
Incomplete blacklist in sanitize_string in Zenphoto before 1.4.9 allows remote...
Medium 6.1

Affected Vendor

Affected Software

zenphoto
Vulnerable Versions:
0

Timeline

Official Publish: February 26th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.