{"id":"CVE-2020-15227","aliases":["DEBIAN-CVE-2020-15227","DLA-2617-1","EUVD-2020-1420","GHSA-8gv3-3j7f-wg94","UBUNTU-CVE-2020-15227","USN-5983-1"],"status":"published","title":"Remote Code Execution vulnerability","description":"Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.","severity":{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.34424,"percentile":0.98436,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-74","CWE-94"],"published":"2020-10-01T19:00:19Z","modified":"2026-10-20T10:51:54Z","exploits":[{"source":"pocgithub","id":"Langriklol/CVE-2020-15227","title":"Langriklol/CVE-2020-15227","date":"2020-10-09","url":"https://github.com/Langriklol/CVE-2020-15227"},{"source":"pocgithub","id":"hu4wufu/CVE-2020-15227","title":"hu4wufu/CVE-2020-15227","date":"2020-10-10","url":"https://github.com/hu4wufu/CVE-2020-15227"},{"source":"pocgithub","id":"filipsedivy/CVE-2020-15227","title":"filipsedivy/CVE-2020-15227","date":"2020-11-15","url":"https://github.com/filipsedivy/CVE-2020-15227"},{"source":"nuclei","id":"CVE-2020-15227","title":"Nette Framework - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15227.yaml"}],"fixes":[{"ecosystem":"Packagist","package":"nette/application","fixed_in":["2.2.10","2.3.14","2.4.16","3.0.6","2.0.19","2.1.13"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:9","package":"php-nette","fixed_in":["2.4-20160731-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php-nette","fixed_in":["2.3.8-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"php-nette","fixed_in":["2.4-20160731-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"nette/application","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.10"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"nette/application","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.14"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"nette/application","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.16"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"nette/application","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.6"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"nette/application","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.19"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"nette/application","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.13"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"php-nette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-20160731-1+deb9u1"}]}],"versions":["2.4-20160731-1"]},{"source":"osv","ecosystem":"Packagist","package":"nette/application","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.10"}]}],"versions":["v2.2.0","v2.2.1","v2.2.2","v2.2.3","v2.2.4","v2.2.5","v2.2.6","v2.2.7","v2.2.8","v2.2.9"]},{"source":"osv","ecosystem":"Packagist","package":"nette/application","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.14"}]}],"versions":["v2.3.0","v2.3.1","v2.3.10","v2.3.11","v2.3.12","v2.3.13","v2.3.2","v2.3.3","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9"]},{"source":"osv","ecosystem":"Packagist","package":"nette/application","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.16"}]}],"versions":["v2.4.0","v2.4.1","v2.4.10","v2.4.11","v2.4.12","v2.4.13","v2.4.14","v2.4.15","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.4.9"]},{"source":"osv","ecosystem":"Packagist","package":"nette/application","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.6"}]}],"versions":["v3.0.0","v3.0.1","v3.0.2","v3.0.2.1","v3.0.3","v3.0.4","v3.0.5"]},{"source":"osv","ecosystem":"Packagist","package":"nette/application","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.19"}]}]},{"source":"osv","ecosystem":"Packagist","package":"nette/application","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.13"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php-nette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-1ubuntu1+esm1"}]}],"versions":["2.3.4-1","2.3.5-1","2.3.7-1","2.3.8-1","2.3.8-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php-nette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-20160731-1ubuntu0.1"}]}],"versions":["2.4-20160731-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php-nette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-1ubuntu1+esm1"}]}],"versions":["2.3.4-1","2.3.5-1","2.3.7-1","2.3.8-1","2.3.8-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php-nette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-20160731-1ubuntu0.1"}]}],"versions":["2.4-20160731-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"nette","product":"application"}],"references":[{"url":"https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://packagist.org/packages/nette/application","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://packagist.org/packages/nette/nette","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00003.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15227","tags":["advisory"]},{"url":"https://blog.nette.org/en/cve-2020-15227-potential-remote-code-execution-vulnerability","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/nette/application/CVE-2020-15227.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8gv3-3j7f-wg94"},{"url":"https://github.com/nette/application","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2020-15227","tags":["report"]},{"url":"https://github.com/nette/application/commit/5b39e53674c9ad2ab0b9916c3fc7becf472f67cb","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5983-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15227","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-15227","title":"Remote Code Execution vulnerability","description":"Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.","status":"published","published":"2020-10-01T19:00:19Z","modified":"2024-08-04T13:08:22.829Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2020-1420","description":"Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.","status":"published","published":"2020-10-01T19:00:19Z","modified":"2024-08-04T13:08:22Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:07:32.55679Z"}],"ghsa":[{"id":"GHSA-8gv3-3j7f-wg94","title":"Potential Remote Code Execution vulnerability","description":"Packages nette/application versions prior to 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette versions prior to 2.0.19 and 2.1.13 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. \n\nReported by Cyku Hong from DEVCORE (https://devco.re)\n\n### Impact\nCode injection, possible remote code execution.\n\n### Patches\nFixed in nette/application 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette 2.0.19 and 2.1.13","status":"published","published":"2020-10-02T16:22:19Z","modified":"2024-02-07T18:14:42Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T14:37:36.076201Z"}],"nvd":[{"id":"CVE-2020-15227","description":"Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.","status":"published","published":"2020-10-01T19:15:12.797Z","modified":"2026-06-17T02:56:18.73Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T14:06:17.70091Z"}],"osv":[{"id":"CVE-2020-15227","description":"Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.","status":"published","published":"2020-10-01T19:15:12.797Z","modified":"2026-10-20T10:51:54.359692124Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"GHSA-8gv3-3j7f-wg94","title":"Potential Remote Code Execution vulnerability","description":"Packages nette/application versions prior to 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette versions prior to 2.0.19 and 2.1.13 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. \n\nReported by Cyku Hong from DEVCORE (https://devco.re)\n\n### Impact\nCode injection, possible remote code execution.\n\n### Patches\nFixed in nette/application 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette 2.0.19 and 2.1.13","status":"published","published":"2020-10-02T16:22:19Z","modified":"2026-07-08T06:29:28.739222447Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"UBUNTU-CVE-2020-15227","description":"Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.","status":"published","published":"2020-10-01T19:15:00Z","modified":"2026-02-04T02:35:35.625315Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"DLA-2617-1","title":"php-nette - security update","status":"published","published":"2021-04-04T00:00:00Z","modified":"2026-03-09T01:21:15.183228Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"USN-5983-1","title":"php-nette vulnerability","description":"Cyku Hong discovered that Nette was not properly handling and validating\ndata used for code generation. A remote attacker could possibly use this\nissue to execute arbitrary code.\n","status":"published","published":"2023-03-29T13:52:48Z","modified":"2026-06-25T13:31:55.717837812Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}