CVE-2020-14209: Malicious File Upload
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be executed as PHP code to defeat the .noexe protection mechanism).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-14209.
What is the severity of CVE-2020-14209?
The severity of CVE-2020-14209 is high with a severity value of 8.8.
How does CVE-2020-14209 impact Dolibarr before version 11.0.5?
CVE-2020-14209 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution in Dolibarr before version 11.0.5.
What types of files can be uploaded to exploit CVE-2020-14209?
The types of files that can be uploaded to exploit CVE-2020-14209 are .pht and .phar files.
How can CVE-2020-14209 be fixed?
To fix CVE-2020-14209, it is recommended to update Dolibarr to version 11.0.5 or later.