Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file.
Published July 29, 2020.
Concrete5 Concrete5