CVE-2017-14346: Blog Project Blog

Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days.

upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file.

Affected products

• Blog Project Blog: up to and including 2017-09-12

Published 2017-09-12. Last modified 2026-06-17.