CVE-2018-20127: Zzzcms Zzzphp

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

An issue was discovered in zzzphp cms 1.5.8. del_file in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because (for example) "php" is blocked but path=F:/1.phP. succeeds.

Affected products

• Zzzcms Zzzphp: version 1.5.8 only

Published 2018-12-13. Last modified 2026-06-17.