CVE-2008-2267: CMS Made Simple

High severity, CVSS 7.5. EPSS: 4.8% chance of exploitation in the next 30 days.

Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/.

Affected products

• CMS Made Simple CMS Made Simple: version 1.2.4 only

Published 2008-05-16. Last modified 2026-06-16.