CVE-2016-7902

CVE-2016-7902 describes an unrestricted file upload vulnerability in Dotclear versions prior to 2.10.3, specifically within the fileUnzip->unzip method. This flaw allows authenticated users with media management permissions to execute arbitrary code by uploading a specially crafted ZIP file containing files with disguised extensions, such as .php.txt. The vulnerability carries a high CVSSv3 score of 8.8, indicating a critical risk due to its network-based attack vector, low attack complexity, and high potential for confidentiality, integrity, and availability impacts. There is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.