Arbitrary file upload in Fork CMS

ALTO 8.8CVE-2021-28931 · GHSA-748f-wv76-x9hg · Published 07/07/2021 · updated 17/06/2026

Em resumo

CVE-2021-28931 é uma vulnerabilidade ALTO (CVSS 8.8) que afeta forkcms/forkcms, fork cms (fork-cms).
Chance de exploração nos próximos 30 dias (EPSS): 1.2%, maior que 68.5% das vulnerabilidades.
Correção: atualize para 5.9.3 ou posterior.

Package	Affected versions	Patched versions
forkcms/forkcms Packagist	`< 5.9.3`	`5.9.3`
fork cms fork-cms	`= 5.9.2`	No fix yet

Description

Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file uploaded to the Themes panel.

NVD description

Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file uploaded to the Themes panel.

References

nvd.nist.gov/vuln/detail/CVE-2021-28931 · ADVISORY
forkcms/forkcms#3351 · WEB
bousalman/ForkCMS-arbitrary-upload · WEB
forkcms/forkcms release 5.9.2 · WEB

Mais vulnerabilidades de forkcms/forkcms

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

forkcms/forkcms

Packagist

< 5.9.3

5.9.3

fork cms

fork-cms

= 5.9.2

No fix yet

Description

Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file uploaded to the Themes panel.

NVD description

Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file uploaded to the Themes panel.

Mais vulnerabilidades de forkcms/forkcms

Ver tudo →