SiteServer CMS RCE via unsafe file upload

HIGH 7.2CVE-2019-11401 · GHSA-ff4w-8chr-w2x9 · Published 22/04/2019 · updated 17/06/2026

In short

CVE-2019-11401 is a HIGH (CVSS 7.2) vulnerability affecting sscms, siteserver cms (siteserver).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.7% of all vulnerabilities.
Fix: update to 6.12 or later.

Package	Affected versions	Patched versions
sscms NuGet	`< 6.12`	`6.12`
siteserver cms siteserver	`= 6.9.0`	No fix yet

Description

A issue was discovered in SiteServer CMS prior to version 6.12. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted.

NVD description

A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted.

References

nvd.nist.gov/vuln/detail/CVE-2019-11401 · ADVISORY
siteserver/cms · WEB
siteserver/cms commit a7edb9c · WEB
siteserver/cms · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free