Sentcms · Sentcms · CVE-2022-24651
**Name of the Vulnerable Software and Affected Versions**
sentcms versions 4.0.x
**Description**
The issue allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution through the "/user/upload/upload" API endpoint.
**Recommendations**
For sentcms versions 4.0.x, consider disabling the file upload feature or restricting access to the "/user/upload/upload" API endpoint until a patch is available.