CVE-2008-1866: Pixel Motion Blog

High severity, CVSS 9.0. EPSS: 5.2% chance of exploitation in the next 30 days.

admin/modif_config.php in Blog Pixel Motion (aka PixelMotion) does not require admin authentication, which allows remote authenticated users to upload arbitrary PHP scripts in a ZIP archive, which is written to templateZip/ and then automatically extracted under templates/ for execution via a direct request.

Affected products

• Pixel Motion Pixel Motion Blog: any version

Published 2008-04-17. Last modified 2026-06-16.