PT-2026-6562 · Jizhicms+1 · Jizhicms

Iej1Ctk1G · Published 2026-02-05 · Updated 2026-02-05 · CVE-2020-37117

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions jizhiCMS version 1.6.7

Description The software contains a file download issue in the admin plugins update endpoint. Authenticated administrators can download arbitrary files. Attackers can exploit this by sending crafted POST requests with malicious filepath and download url parameters, triggering unauthorized file downloads. The vulnerable API endpoint is '/admin/plugins/update'.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-37117

Affected Products

Jizhicms

References · 5

• 🔥 https://exploit-db.com/exploits/48361 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37117 · Security Note
• https://osv.dev/vulnerability/CVE-2020-37117 · Vendor Advisory
• https://vulncheck.com/advisories/jizhicms-arbitrary-file-download · Note
• https://jizhicms.cn · Note