CVE-2018-3814

Name of the Vulnerable Software and Affected Versions Craft CMS version 2.6.3000

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by using the "Assets->Upload files" screen and then the "Replace it" option, which enables a .jpg file to have embedded PHP code, and then be renamed to a .php extension.

Recommendations For Craft CMS version 2.6.3000, consider restricting access to the "Assets->Upload files" screen and the "Replace it" option to minimize the risk of exploitation. As a temporary workaround, consider disabling the ability to upload files with embedded PHP code until a patch is available.