CVE-2017-18048: Monstra CMS case-sensitive extension check allows arbitrary file upload RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityAuthenticated remote code execution with public exploit code and very high EPSS, though it requires a valid low-privileged account and the product is an older CMS.

What it is

Monstra CMS 3.0.4 blocks the lowercase .php extension on uploads but not the uppercase .PHP, so an authenticated user can upload a PHP file that the server executes. This is an unrestricted file upload (CWE-434) leading directly to remote command execution on the web server.

Impact

An attacker with a low-privileged account gains remote command execution as the web server user, allowing full compromise of the application and any data or host resources reachable from that process.

Attack surface

Reached over the network through the CMS file upload functionality; the CVSS vector (AV:N/PR:L/UI:N) indicates a low-privileged authenticated account is required and no user interaction is needed.

Exploitation

Public exploit code exists (Exploit-DB 43348 and two third-party exploit write-ups), and EPSS is 0.63355 (99.2nd percentile), indicating high near-term exploitation likelihood; the CVE is not listed in CISA KEV.

What to do

• Upgrade Monstra CMS to a version that fixes the upload validation issue (see the vendor GitHub issue 426 patch reference); if no fixed release is available, migrate off the unsupported CMS.
• Enforce case-insensitive extension and MIME-type allowlisting on all uploads, and reject double extensions and executable types.
• Store uploaded files outside the web root and serve them through a handler that never executes them.
• Disable PHP execution in upload directories via web server configuration.
• Restrict upload privileges to trusted roles and audit existing accounts with upload rights.

Detection

• Monitor web server logs for POST requests to upload endpoints followed by requests to newly written files with .PHP or mixed-case executable extensions.
• Alert on creation of executable files (.php, .phtml, .PHP) inside upload or content directories.
• Hunt for web server child processes spawning shells or unexpected system commands.
• Review file integrity monitoring for new or modified files in web-accessible directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.