CRITICAL9.8

GHSA-pcf7-5974-vjh4

Elefant CMS Improper Input Validation

Quick fix

GHSA-pcf7-5974-vjh4 — elefant/cms: upgrade to the fixed version with the command below.

composer require elefant/cms:^2.0.4

Details

`apps/filemanager/handlers/upload/drop.php` in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" protection mechanism.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/elefant/cms

Introduced in: 0Fixed in: 2.0.4

Fixcomposer require elefant/cms:^2.0.4

References

https://nvd.nist.gov/vuln/detail/CVE-2018-15601[ADVISORY]
https://github.com/jbroadway/elefant/commit/afb3346e50b992bcba143660ca2149e563430e05[WEB]