CVE-2020-9280

In SilverStripe up to 4.x (notably 4.5), files uploaded via Forms to folders migrated from SilverStripe CMS 3.x may be placed in the default /Uploads folder. This affects installations with the optional silverstripe/secureassets module (enabled by default on the Common Web Platform). The vulnerab...

CVE-2020-9280

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is...

CVE-2020-9280: Folders migrated from 3.x may be unsafe to upload to

More info at https://www.silverstripe.org/download/security-releases/cve-2020-9280/...