CVE-2021-44912

Name of the Vulnerable Software and Affected Versions XE versions prior to 1.11.2 XE version 1.116

Description The issue arises from the lack of restriction on file suffixes when uploading files using the Normal button, allowing any file type to be uploaded to the files directory. Since the .htaccess configuration only restricts PHP file types, uploading HTML files can lead to stored XSS vulnerabilities. If the .htaccess configuration is improper, it is possible to upload PHP files, potentially leading to remote code execution.

Recommendations For XE versions prior to 1.11.2, consider updating the .htaccess configuration to properly restrict file types. For XE version 1.116, restrict access to the file upload feature until a proper fix is applied, and ensure the .htaccess configuration is correctly set up to prevent the upload of malicious files. As a temporary workaround, consider disabling the file upload feature via the Normal button until a patch is available.