CVE-2019-17536 describes an unrestricted file upload vulnerability in Gila CMS versions through 1.11.4, specifically within the moveAction function of core/controllers/fm.php. This medium-severity vulnerability (CVSS 4.9) allows an authenticated attacker with high privileges to upload dangerous file types, potentially leading to arbitrary code execution or data integrity compromise. While no public exploits or active exploitation have been observed, and community discussion is minimal, the flaw could still be leveraged by an attacker with administrative access.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.11.4CPE matchmatch criteria | cpe:2.3:a:gilacms:gila_cms:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.