CVE-2020-37117
jizhiCMS 1.6.7 - Arbitrary File Download
- State
- Published
- Severity
- 8.6 High
- Published
- Feb 5, 2026
- Updated
- Mar 5, 2026
- Reserved
- Feb 3, 2026
Description
jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitrary files. Attackers can exploit the vulnerability by sending crafted POST requests with malicious filepath and download_url parameters to trigger unauthorized file downloads.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
jizhiCMSjizhiCMS |
|
References
- ExploitDB-48361exploit
- Official Vendor Homepageproduct
- VulnCheck Advisory: jizhiCMS 1.6.7 - Arbitrary File Downloadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.