VULNERABILITY INTELLIGENCE

CVE-2010-5091

CVSS score6 MEDIUM
EPSS probability1.37%
CISA KEVNot currently listed
Published2012-08-26
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:S/C:P/I:P/A:P

Description

The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references