Concrete CMS: Authenticated path traversal to RCE

crayons Description The bFilename parameter in the scenario index.php/ccm/system/dialogs/block/design/submit is vulnerable to remote code execution via path traversal vulnerability. Authenticated attacker with rights to edit web application pages can upload malicious PNG file containing PHP code...

Fedora 29 : php (2019-187ae3128d)

PHP version 7.2.24 24 Oct 2019 Core: - Fixed bug php78535 autodetectlineendings value not parsed as bool. bugreportuser - Fixed bug php78620 Out of memory error. cmb, Nikita Exif: - Fixed bug php78442 'Illegal component' on exifreaddata since PHP7 Kalle FPM: - Fixed bug php78599 envpathinfo...