Homepage
About Snyk

Arbitrary Code Execution Affecting concrete5/concrete5 package, versions <8.5.7

0.0
medium

Snyk CVSS

    Attack Complexity High
    Privileges Required High
    User Interaction Required
    Scope Changed
    Integrity High

    Threat Intelligence

    EPSS 0.95% (83rd percentile)
Expand this section
NVD
7.2 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PHP-CONCRETE5CONCRETE5-1925024
  • published 24 Nov 2021
  • disclosed 23 Nov 2021
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 23 Nov 2021

CVE-2021-22968 Open this link in a new tab
CWE-98 Open this link in a new tab

How to fix?

Upgrade concrete5/concrete5 to version 8.5.7 or higher.

Overview

concrete5/concrete5 is a concrete5 open source CMS.

Affected versions of this package are vulnerable to Arbitrary Code Execution via bypass of adding remote files in File Manager. The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with a random name, but it's possible to stall the uploads and brute force the directory name.