CVE-2020-9471

HIGH

Umbraco CMS 8.5.3 - Authenticated Remote Code Execution via Install Packages File Upload

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-9471. PoCs published by eLeN3Re.

AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2020-9471, targeting Umbraco Cloud 8.5.3. The exploit leverages an authenticated file upload vulnerability to achieve remote code execution (RCE) by uploading a malicious ZIP package.

Description

Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.

Exploits (1)

gitlab WORKING POC

by eLeN3Re · poc

https://gitlab.com/eLeN3Re/cve-2020-9471

View Code ZIP pw:eip

This repository contains a functional Python exploit for CVE-2020-9471, targeting Umbraco Cloud 8.5.3. The exploit leverages an authenticated file upload vulnerability to achieve remote code execution (RCE) by uploading a malicious ZIP package.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Umbraco Cloud 8.5.3

Auth required

Prerequisites: Authenticated access to Umbraco Cloud · Ability to create a bogus account

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 23, 2026 Full analysis →

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://gitlab.com/eLeN3Re/cve-2020-9471

Scores

CVSS v3 8.8

EPSS 0.0294

EPSS Percentile 86.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-434

Status published

Products (2)

nuget/UmbracoCMS.Core 0NuGet

umbraco/umbraco_cms 8.5.3

Published Mar 16, 2020

Tracked Since Feb 18, 2026