CVE-2020-29597: IncomCMS unauthenticated file upload in showcase script

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable arbitrary file upload with CVSS 9.8 and very high EPSS makes full host compromise likely if the endpoint is exposed.

What it is

IncomCMS 2.0 exposes modules/uploader/showcase/script.php, which accepts file uploads without validating the uploader or the file type. Because the endpoint is reachable without authentication, an attacker can place arbitrary files on the server, which is a direct path to remote code execution if the uploaded file is web-accessible and executable.

Impact

An attacker gains the ability to write arbitrary files to the server, which typically leads to code execution under the web server account and full compromise of the application host.

Attack surface

The flaw is reached over the network through the modules/uploader/showcase/script.php endpoint. The CVSS vector shows PR:N and UI:N, so no authentication and no user interaction are required.

Exploitation

CVE-2020-29597 is not listed in CISA KEV, but public exploit write-ups are referenced and EPSS is 0.71006 (99.4th percentile), indicating a high likelihood of attempted exploitation.

What to do

• Upgrade or patch IncomCMS to a version that fixes the uploader endpoint; if no fixed release exists, remove or disable modules/uploader/showcase/script.php.
• Restrict access to uploader paths at the web server or WAF so only authenticated, trusted clients can reach them.
• Enforce server-side file type, extension and content validation, and store uploads outside the web root with execute permissions disabled.
• Run the web server with least privilege and disable execution of scripts in upload directories.
• Monitor vendor and community advisories for an official fix, since the record does not name a patched version.

Detection

• Review web server logs for POST requests to /modules/uploader/showcase/script.php and other uploader endpoints, especially from unauthenticated clients.
• Alert on newly created files in web-accessible upload directories, particularly files with executable extensions such as .php.
• Scan the upload directories for unexpected or recently modified files and compare against known-good content.
• Correlate upload activity with subsequent requests to the uploaded file paths, which may indicate exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.