CVE-2020-26806

2021-07-3116:13:31

mitre

www.cve.org

9 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.6%

JSON

admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP code.

References

packetstormsecurity.com/files/163709/ObjectPlanet-Opinio-7.13-Shell-Upload.html

www.objectplanet.com/opinio/changelog.html