CVE-2018-16731

PoC —

CVSS 3.0

9.8 critical

EPSS

1%p73

Published

Sep 8, 2018 (Sep 8, 2018)

Modified

Jun 17, 2026

Description

CScms 4.1 allows arbitrary file upload by (for example) adding the php extension to the default filetype list (gif, jpg, png), and then providing a .php pathname within fileurl JSON data.

Vendors: chshcms
Products: cscms
Weakness: CWE-434
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news0 stories

No ingested article mentions this CVE yet.