CVE-2020-13443: Unrestricted Upload of File with Dangerous Type

ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft actions. A user with low privileges member is able to upload this. It is possible to bypass the MIME type check and file-extension check...

PT-2020-13544

Name of the Vulnerable Software and Affected Versions ExpressionEngine versions prior to 5.3.2 Description The issue allows remote attackers to upload and execute arbitrary code in a .php file. This can be achieved via Compose Msg, Add attachment, and Save As Draft actions, exploiting the ability...