← Vulnerability feed

Vulnerability record · CVE-2020-13443 · published 24 June 2020

CVE-2020-13443: Expressionengine unrestricted file upload vulnerability

Expressionengine · Expressionengine

ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft actions. A user with low privileges (member) is able to upload this. It is possible to bypass the MIME type check and file-extension check while uploading new files. Short aliases are not used for an attachment; instead, direct access is allowed to the uploaded files. It is possible to upload PHP only if one has member access, or registration/forum is enabled and one can create a member with the default group id of 5. To exploit this, one must to be able to send and compose messages (at least).

8.8 CVSS 3.1 High EPSS 4.1% · top 9.5% CWE-434 · Unrestricted file upload
8.8CVSS 3.1 base score, v2 6.5
4.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft actions. A user with low privileges (member) is able to upload this. It is possible to bypass the MIME type check and file-extension check while uploading new files. Short aliases are not used for an attachment; instead, direct access is allowed to the uploaded files. It is possible to upload PHP only if one has member access, or registration/forum is enabled and one can create a member with the default group id of 5. To exploit this, one must to be able to send and compose messages (at least).

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://expressionengine.com/blog Vendor Advisory
https://gist.github.com/mariuszpoplwski/51604d8a6d7d78fffdf590c25e844e09 ExploitThird Party Advisory
https://expressionengine.com/blog Vendor Advisory
https://gist.github.com/mariuszpoplwski/51604d8a6d7d78fffdf590c25e844e09 ExploitThird Party Advisory

Track CVE-2020-13443 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-33199Expressionengine improper input validation vulnerabilityIn Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fix…EPSS 1.4%8.8CVE-2023-22953Expressionengine vulnerabilityIn ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.EPSS 1.4%8.8CVE-2021-27230Expressionengine code injection vulnerabilityExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to wri…EPSS 2.8%7.5CVE-2017-0897Expressionengine vulnerabilityExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can l…EPSS 4.0%7.2CVE-2025-59473Expressionengine sql injection vulnerabilitySQL Injection vulnerability in the Structure for Admin authenticated userEPSS 0.30%7.2CVE-2020-8242Expressionengine sql injection vulnerabilityUnsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin con…EPSS 0.93%6.5CVE-2014-5387Ellislab expressionengine sql injection vulnerabilityMultiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands v…EPSS 1.6%6.1CVE-2024-38454Expressionengine cross-site scripting vulnerabilityExpressionEngine before 7.4.11 allows XSS.EPSS 0.30%

Source: NIST National Vulnerability Database (record CVE-2020-13443), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.