CVE-2017-7402

PoC —

CVSS 3.0

9.8 critical

EPSS

5%p92

Published

Apr 3, 2017 (Apr 3, 2017)

Modified

Jun 17, 2026

Description

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg.

Vendors: lucidcrew
Products: pixie
Weakness: CWE-94
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (5.0%)

In the news0 stories

No ingested article mentions this CVE yet.