CVE-2020-36079

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop files into the Files(elFinder) portion of the UI. This can, for example, place a .php file in the server's uploaded/ directory. NOTE: the vendor disputes this because exploitation can only be performed by an admin who has "lots of other possibilities to harm a site.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/161569/Zenphoto-CMS-1.5.7-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/zenphoto/zenphoto/issues/1292Third Party Advisory
https://www.zenphoto.org/news/why-not-every-security-issue-is-really-an-issue/Vendor Advisory
http://packetstormsecurity.com/files/161569/Zenphoto-CMS-1.5.7-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/zenphoto/zenphoto/issues/1292Third Party Advisory
https://www.zenphoto.org/news/why-not-every-security-issue-is-really-an-issue/Vendor Advisory

Timeline

Published: Feb 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-360829.8File Upload vulnerability in bloofoxCMS version 0.5.2.1, allows remote attackers to execute arbitrary code and escalate privileges via craft CVE-2020-360849.8SQL Injection vulnerability in SourceCodester Responsive E-Learning System 1.0 allows remote attackers to inject sql query in /elearning/del CVE-2020-360856.3Stored Cross Site Scripting(XSS) vulnerability in Egavilan Media Resumes Management and Job Application Website 1.0 allows remote attackers CVE-2020-36107.8Possibility of double free of the drawobj that is added to the drawqueue array of the context during IOCTL commands as there is no refcount CVE-2020-361099.8ASUS RT-AX86U router firmware below version under 9.0.0.4_386 has a buffer overflow in the blocking_request.cgi function of the httpd module CVE-2020-36117.8u'XBL SEC clears only ZI region when loading Qualcomm-signed segments can lead to improper access issue' in Snapdragon Compute, Snapdragon C CVE-2020-361129.8CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in book CVE-2020-361155.4Stored Cross Site Scripting (XSS) vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or La CVE-2020-361207.5Buffer Overflow in the "sixel_encoder_encode_bytes" function of Libsixel v1.8.6 allows attackers to cause a Denial of Service (DoS).CVE-2020-361246.5Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External Entity (XXE) injection. An authenticated attacker can co CVE-2020-361257.1Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control where password revalidation in sensitive ope CVE-2020-361268.1Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control that can lead to remote privilege escalation