Typesetter · Typesetter Cms · CVE-2020-25790
**Name of the Vulnerable Software and Affected Versions**
Typesetter CMS versions 5.x through 5.1
**Description**
The issue allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. This behavior contradicts the security policy, and the vendor is fixing it for version 5.2, despite considering admins trustworthy.
**Recommendations**
For versions 5.x through 5.1, consider disabling the upload functionality for ZIP archives containing .php files until a patch is available.
As a temporary workaround, restrict access to the upload feature to minimize the risk of exploitation.
Avoid using the upload feature for ZIP archives until the issue is resolved in version 5.2.