CVE-2020-24949: PHP-Fusion downloads.php privilege escalation to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw allows authenticated non-admin users to reach remote code execution, public exploit code exists, and EPSS is very high, though it is not in KEV and requires a valid account.

What it is

PHP-Fusion 9.03.50 contains a privilege escalation flaw in downloads/downloads.php that lets an authenticated non-admin user send a crafted request and achieve remote command execution. Because the attacker only needs a low-privileged account, the flaw turns ordinary forum or site membership into a path to full server compromise.

Impact

An authenticated non-admin attacker can execute arbitrary commands on the server, gaining control of the web application and potentially the underlying host. This can lead to data theft, defacement, or use of the server as a foothold for further attacks.

Attack surface

The flaw is reached over the network through the downloads/downloads.php endpoint. It requires a valid authenticated account but no admin rights and no user interaction beyond sending the crafted request.

Exploitation

Public exploit code is referenced in Packet Storm and the PHP-Fusion GitHub issue, and EPSS is high at roughly 0.675 (99th percentile), though the CVE is not listed in CISA KEV and no ransomware use is documented.

What to do

• Upgrade PHP-Fusion to a version that fixes the downloads.php privilege escalation; if no fixed release is available, apply the vendor patch or commit referenced in the GitHub issue.
• Restrict or disable the downloads module until patched, and remove untrusted accounts that could reach it.
• Enforce least privilege and review non-admin roles so low-privileged users cannot reach administrative or file-handling functionality.
• Deploy a WAF rule to block crafted requests to downloads/downloads.php and monitor for command injection patterns.
• Audit the server for signs of compromise and rotate credentials and secrets if exploitation is suspected.

Detection

• Monitor web logs for unusual POST or GET requests to downloads/downloads.php, especially from non-admin sessions.
• Alert on command execution or shell-related child processes spawned by the web server user.
• Look for unexpected file writes or new files in web-accessible directories following downloads module activity.
• Correlate authenticated low-privilege user activity with outbound network connections or privilege changes on the host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.