CVE-2020-24986

Name of the Vulnerable Software and Affected Versions Concrete5 versions up to and including 8.5.2

Description The issue allows for the unrestricted upload of files with dangerous types, such as .php files, via the File Manager. This can be achieved by modifying the site configuration to upload the PHP file, which can then be used to execute arbitrary commands.

Recommendations For Concrete5 versions up to and including 8.5.2, update to a version that restricts the upload of dangerous file types or modify the site configuration to prevent such uploads. As a temporary workaround, consider restricting access to the File Manager to minimize the risk of exploitation.