CVE-2021-39500

Name of the Vulnerable Software and Affected Versions: Eyoucms version 1.5.4

Description: The issue is related to a lack of input data sanitization in parameters tpldir, filename, type, and nid. This allows an attacker to inject "../" and escape, potentially writing files to writable directories.

Recommendations: For Eyoucms version 1.5.4, consider restricting access to the parameters tpldir, filename, type, and nid to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.