critical9.8
CVE-2016-11020
Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png.
Impact
Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kunena | Kunena | before 5.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/Kunena/Kunena-Forum/pull/5028
- https://www.kunena.org/blog/179-kunena-5-0-4-released
- https://www.kunena.org/bugs/changelog
- https://github.com/Kunena/Kunena-Forum/pull/5028
- https://www.kunena.org/blog/179-kunena-5-0-4-released
- https://www.kunena.org/bugs/changelog