CVE-2020-10806
eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type
eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution.
- Record
CVE-2020-10806- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-434
- Updated
- 2026-11-02
CVE List No score
eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution.
- Record
CVE-2020-10806- Updated
- 2026-11-02
EUVDEUVD-2022-2496 No score
eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution.
- Record
EUVD-2022-2496- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-54p5-gxq6-j98g
eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type
eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution.
- Record
GHSA-54p5-gxq6-j98g- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution.
- Record
CVE-2020-10806- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-54p5-gxq6-j98g
eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type
eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution.
- Record
GHSA-54p5-gxq6-j98g- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ezsystems/ezpublish-kernelPackagist |
before 5.4.14.1 | 5.4.14.1 |
ezsystems/ezpublish-legacyPackagist |
before 5.4.14.1 | 5.4.14.1 |
ezsystems/ezpublish-kernelPackagist |
6.0 up to 6.13.6.2 | 6.13.6.2 |
ezsystems/ezpublish-kernelPackagist |
7.0 up to 7.5.6.2 | 7.5.6.2 |
ezsystems/ezpublish-legacyPackagist |
2017 up to 2017.12.7.2 | 2017.12.7.2 |
ezsystems/ezpublish-legacyPackagist |
2019 up to 2019.03.4.2 | 2019.03.4.2 |
ezsystems/ezpublish-kernelPackagist |
before 5.4.14.1, plus listed versions 5.0.05.1.0-beta25.1.0-rc15.1.0-stable5.2.05.2.0-beta15.2.0-rc1 |
5.4.14.1 |
ezsystems/ezpublish-kernelPackagist |
6.0 up to 6.13.6.2, plus listed versions v6.0.0v6.0.0-alpha1v6.0.0-alpha2v6.0.0-alpha3v6.0.0-alpha4 Show 45 moreShow lessv6.0.0-alpha5v6.0.0-alpha6v6.0.0-alpha7v6.0.0-beta1v6.0.0-beta2v6.0.0-beta3v6.0.0-beta4v6.0.0-beta5v6.0.0-beta6v6.0.0-beta7v6.0.0-beta8v6.0.0-rc1v6.0.0.1v6.0.0.2v6.0.1v6.0.1.1v6.0.1.2v6.0.1.3v6.0.1.4v6.0.1.5v6.0.1.6v6.0.1.7v6.1.0v6.1.0-rc1v6.1.1v6.1.1.1v6.10.0v6.10.0-beta1v6.10.0-beta2v6.10.0-beta3v6.10.0-rc1v6.10.0-rc2v6.10.0-rc3v6.10.1v6.10.1-rc1v6.11.0v6.11.0-beta1v6.11.0-rc1v6.11.1v6.11.2v6.11.3v6.11.4v6.11.4.1v6.12.0v6.12.0-beta1 |
6.13.6.2 |
ezsystems/ezpublish-kernelPackagist |
7.0 up to 7.5.6.2, plus listed versions v7.0.0v7.0.0-beta1v7.0.0-beta2v7.0.0-beta3v7.0.0-rc1 Show 45 moreShow lessv7.0.1v7.0.2v7.0.2.1v7.0.2.2v7.0.2.3v7.1.0v7.1.0-beta1v7.1.0-beta2v7.1.0-rc1v7.1.0-rc2v7.1.0.1v7.1.0.2v7.1.1v7.1.1-rc1v7.1.1.1v7.2.0v7.2.0-beta1v7.2.0-rc1v7.2.1v7.2.2v7.2.3v7.2.4v7.2.4.1v7.2.5v7.3.0v7.3.0-beta1v7.3.0-rc1v7.3.0-rc2v7.3.1v7.3.2v7.3.2.1v7.3.3v7.3.4v7.3.5v7.4.0v7.4.0-beta1v7.4.0-rc1v7.4.1v7.4.2v7.4.3v7.4.3-rc1v7.4.4v7.5.0v7.5.0-rc1v7.5.0-rc2 |
7.5.6.2 |
ezsystems/ezpublish-legacyPackagist |
2017 up to 2017.12.7.2, plus listed versions v2017.08.0v2017.08.1v2017.08.1.1v2017.10.0v2017.10.0-RC1 Show 17 moreShow lessv2017.10.1v2017.12.0v2017.12.1v2017.12.1.1v2017.12.2v2017.12.2.1v2017.12.2.2v2017.12.3v2017.12.3.1v2017.12.3.2v2017.12.4v2017.12.4.1v2017.12.4.2v2017.12.4.3v2017.12.5v2017.12.6v2017.12.7 |
2017.12.7.2 |
ezsystems/ezpublish-legacyPackagist |
2019 up to 2019.03.4.2, plus listed versions v2019.03.0v2019.03.0-rc1v2019.03.0-rc2v2019.03.1v2019.03.2v2019.03.3v2019.03.4 |
2019.03.4.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-10806 is a critical vulnerability (CVSS 9.8) in Ez Publish-kernel, published March 22, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.32%, the 83rd percentile. Fixed in ezsystems/ezpublish-kernel 5.4.14.1.
References
Left out here: 137 versions. The JSON record has them.