CVE-2020-28871: Monitorr upload.php unrestricted file upload leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with public exploit code and near-maximum EPSS probability.

What it is

Monitorr 1.7.6m allows an unauthenticated attacker to upload a file through upload.php without validating its type, which can then be executed on the server. This is a critical pre-auth remote code execution flaw in a monitoring web application.

Impact

An attacker can run arbitrary code on the server with the web application's privileges, leading to full host compromise, data theft, or use of the host as a pivot point.

Attack surface

Reached over the network via HTTP requests to upload.php; the CVSS vector shows no privileges or user interaction required, so the endpoint is exposed to unauthenticated users.

Exploitation

Public exploit code is referenced (Exploit-DB, Packet Storm, vendor analysis), and EPSS is very high at 0.998 percentile, though CISA KEV does not list it.

What to do

• Upgrade Monitorr to a fixed release; the record does not name a patched version, so verify with the vendor.
• If patching is not possible, restrict access to upload.php and the Monitorr interface to trusted networks or authenticated users.
• Disable script execution in any directory that accepts uploads and validate file types server-side.
• Remove or isolate the Monitorr instance if it is internet-facing and cannot be patched.
• Monitor the upload directory for unexpected executable files.

Detection

• Alert on POST requests to upload.php that carry executable or script file extensions.
• Watch for new files written to web-accessible upload directories and any subsequent execution of those files.
• Look for outbound connections or child processes spawned by the web server user after upload activity.
• Review web server logs for anomalous upload.php requests from untrusted source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.