MCMS vulnerable to arbitrary code execution via crafted thumbnail

HIGH 8.8CVE-2020-22755 · GHSA-293v-5329-36wp · Published 08/05/2023 · updated 17/06/2026

In short

CVE-2020-22755 is a HIGH (CVSS 8.8) vulnerability affecting net.mingsoft:ms-mcms, mcms (mingsoft).
Chance of exploitation in the next 30 days (EPSS): 0.92%, higher than 60.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
net.mingsoft:ms-mcms Maven	`≤ 5.0.0`	No fix yet
mcms mingsoft	`= 5.0`	No fix yet

Description

File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943.

NVD description

File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943.

References

nvd.nist.gov/vuln/detail/CVE-2020-22755 · ADVISORY
ming-soft/MCMS · WEB
ming-soft/MCMS · PACKAGE

More vulnerabilities in net.mingsoft:ms-mcms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

net.mingsoft:ms-mcms

Maven

≤ 5.0.0

No fix yet

mcms

mingsoft

= 5.0

No fix yet

Description

File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943.

NVD description

File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943.

More vulnerabilities in net.mingsoft:ms-mcms

See all →