CVE-2020-36079: zenphoto

csirt@kutim:~/threat-intel/cve/CVE-2020-36079

CVSS 7.2 · High EPSS 4,7%

Kerentanan Unrestricted Upload of File with Dangerous Type pada zenphoto. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop files into the Files(elFinder) portion of the UI. This can, for example, place a .php file in the server's uploaded/ directory. NOTE: the vendor disputes this because exploitation can only be performed by an admin who has "lots of other possibilities to harm a site.

Rincian

Terbit di NVD: 26 Februari 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 4,7% peluang dieksploitasi; lebih tinggi dari 91,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
zenphoto	zenphoto	Semua versi hingga 1.5.7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.zenphoto.org/news/why-not-every-security-issue-is-really-an-issue/ advisory vendor
http://packetstormsecurity.com/files/161569/Zenphoto-CMS-1.5.7-Shell-Upload.html exploit · advisory pihak ketiga · vdb entry
https://github.com/zenphoto/zenphoto/issues/1292 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.