CVE-2021-39608: FlatCore-CMS upload addon allows unrestricted PHP file upload and RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityNetwork-reachable RCE with public exploit code and a high EPSS score, tempered only by the required authenticated high-privilege access.

What it is

FlatCore-CMS 2.0.7 contains an unrestricted file upload flaw (CWE-434) in the upload addon plugin, letting a remote user place arbitrary PHP code on the server. Because the uploaded file can be executed, this turns into remote code execution on the hosting web server. The record names only version 2.0.7 and does not state whether other versions are affected.

Impact

An attacker who can reach the upload addon can execute arbitrary PHP code on the server, giving control over the web application and its data. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The flaw is network reachable (AV:N) with no user interaction (UI:N), but the CVSS vector requires high privileges (PR:H), so the attacker needs an authenticated account with upload rights. No detail is given on which roles or endpoints are involved.

Exploitation

Public exploit code is referenced (Packetstorm and the project GitHub issue are tagged Exploit), and EPSS is high at 0.459 (98.7th percentile), though the CVE is not listed in CISA KEV. No ransomware use is documented.

What to do

• Upgrade FlatCore-CMS past 2.0.7 to a release that fixes the upload addon; the record does not name a fixed version, so confirm with the vendor.
• If patching is not possible, disable or remove the upload addon plugin.
• Restrict upload permissions to the minimum trusted accounts and review who holds them.
• Configure the web server to refuse execution of PHP (or any script) inside upload directories.
• Validate uploads server-side by extension, MIME type and content, and store them outside the web root.

Detection

• Monitor upload directories for newly written .php or other executable files.
• Alert on web server processes spawning shells or unexpected child processes.
• Review web access logs for POST requests to the upload addon followed by requests to the uploaded file path.
• Audit accounts with upload privileges and flag uploads from unusual users or IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.