CRITICAL9.8

GHSA-6vf2-mfmr-qqqw

Liufee CMS File Upload vulnerability

Quick fix

GHSA-6vf2-mfmr-qqqw — feehi/cms: upgrade to the fixed version with the command below.

composer require feehi/cms:^2.0.8.1

Details

File Upload vulnerability in Liufee CMS, AKA Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the `/admin/index.php?r=admin-user%2Fupdate-self` component.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/feehi/cms

Introduced in: 0Fixed in: 2.0.8.1

Fixcomposer require feehi/cms:^2.0.8.1

References

https://nvd.nist.gov/vuln/detail/CVE-2020-21489[ADVISORY]
https://github.com/liufee/cms/issues/46[WEB]
https://github.com/liufee/cms/commit/ecbfb0ca77874ead5b6e79b96a5e1f94e67475a9[WEB]
https://github.com/liufee/cms[PACKAGE]