CVE-2019-17046

CVE-2019-17046 describes a remote code execution vulnerability in ilch CMS, specifically version 2.1.22. This flaw arises because the "php" file extension is erroneously permitted under "Allowed files" on the admin media settings page, enabling an authenticated attacker to upload and execute malicious PHP code. The vulnerability carries a CVSS score of 7.2 (HIGH), indicating that a high-privileged attacker can achieve complete compromise of confidentiality, integrity, and availability with low attack complexity over the network. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.