PT-2026-30350 · Snewscms · Snews

CVE-2016-20052 · Published 2026-04-04 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Snews CMS version 1.7

Description An unrestricted file upload issue allows unauthenticated attackers to upload arbitrary files, including PHP executables, to the snews files directory. By using the multipart form-data upload endpoint, an attacker can upload malicious PHP files and execute them by accessing the uploaded file path, leading to remote code execution (RCE), which is the ability to execute arbitrary commands on a remote machine.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2016-20052

Affected Products

Snews

References · 4

• 🔥 https://exploit-db.com/exploits/40706 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-20052 · Security Note
• https://t.me/cveNotify/208457 · Telegram Post
• https://vulncheck.com/advisories/snews-cms-unrestricted-file-upload-via-snews-files · Note