CVE-2019-9692: CMS Made Simple Showtime2 watermark upload allows non-image file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityPublic exploit code and a Metasploit module exist and EPSS is very high, but exploitation requires an authenticated low-privileged account and the CVSS impact is limited to integrity.

What it is

The Showtime2 module in CMS Made Simple before 2.2.10 does not verify that a watermark file uses a standard image extension (GIF, JPG, JPEG, PNG). This lets an authenticated user upload a file with an arbitrary extension through the watermark handling code, which is an unrestricted file upload weakness.

Impact

An attacker with a low-privileged account can place a file of their choosing on the server, and public exploits describe chaining this to remote command execution. At minimum it enables hosting of malicious content on the site.

Attack surface

Reached over the network through the Showtime2 image/watermark upload functionality; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N).

Exploitation

Public exploit code exists (Exploit-DB and Packet Storm references tagged Exploit, plus a Rapid7 Metasploit module), and EPSS is high at 0.459 (98.7th percentile), though the CVE is not in CISA KEV.

What to do

• Upgrade CMS Made Simple to 2.2.10 or later, which contains the Showtime2 fix.
• If upgrade is not possible, restrict or disable the Showtime2 module's watermark upload feature.
• Enforce server-side extension and content-type validation on all uploaded files, allowing only image types.
• Store uploaded files outside the web root or serve them without script execution permissions.
• Limit accounts that can access the Showtime2 upload functionality to trusted administrators.

Detection

• Monitor web server and application logs for uploads to Showtime2 paths with extensions other than GIF, JPG, JPEG or PNG.
• Alert on newly created executable files (for example .php) in upload or media directories.
• Review file system for unexpected files in CMSMS upload locations and compare against known content.
• Watch for requests to the Showtime2 image/watermark endpoints from low-privileged accounts followed by access to the uploaded file.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.