CVE-2019-17536

MEDIUM

Gilacms Gila Cms < 1.11.4 - Unrestricted File Upload

Title source: rule
STIX 2.1

Description

Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move.

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://rastating.github.io/gila-cms-upload-filter-bypass-and-rce/
Exploit, Third Party Advisory x_refsource_misc
https://github.com/GilaCMS/gila/pull/49

Scores

CVSS v3 4.9
EPSS 0.0040
EPSS Percentile 60.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-434
Status published
Products (1)
gilacms/gila_cms < 1.11.4
Published Oct 13, 2019
Tracked Since Feb 18, 2026