CVE-2020-7246: qdPM authenticated file upload path traversal leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with public exploit code and a very high EPSS score, though it requires an authenticated low-privileged account and is not in KEV.

What it is

qdPM 9.1 and earlier allows an authenticated user to upload a malicious PHP file through the profile photo feature. A path traversal flaw in the users['photop_preview'] delete photo function lets the attacker bypass .htaccess protection, so the uploaded PHP executes on the server. The issue is an incomplete fix for CVE-2015-3884.

Impact

An attacker with a valid account gains remote code execution on the web server, leading to full compromise of the application and its data. This can extend to the underlying host depending on the web server's privileges.

Attack surface

Reached over the network through the qdPM web interface; the CVSS vector shows PR:L, so a low-privileged authenticated account is required, and no user interaction is needed. The flaw is in the profile photo upload and delete functionality.

Exploitation

Public exploit code is referenced in multiple Packet Storm and third-party advisories, and EPSS is 0.83235 (99.7th percentile), indicating a high likelihood of exploitation. It is not listed in CISA KEV.

What to do

• Upgrade qdPM to a version that fully fixes the incomplete CVE-2015-3884 remediation; if no fixed version is available, treat the product as unsupported and isolate it.
• Restrict access to the qdPM application to trusted networks or place it behind an authenticating reverse proxy.
• Disable PHP execution in upload and profile photo directories, and verify .htaccess or equivalent server rules cannot be bypassed by traversal.
• Audit and remove unnecessary user accounts, and enforce least privilege for any account that can reach the profile photo feature.
• Monitor and restrict outbound traffic from the qdPM host to limit post-exploitation activity.

Detection

• Monitor web server logs for POST requests to profile photo upload endpoints followed by requests to PHP files in upload or user photo directories.
• Alert on path traversal sequences such as ../ in parameters tied to the photop_preview delete function.
• Detect newly created or modified PHP files in upload, cache, or profile photo directories.
• Watch for unexpected child processes spawned by the web server, such as shells or command interpreters.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.