CVE-2019-17536: Gilacms Gila CMS

Medium severity, CVSS 4.9. EPSS: 2.3% chance of exploitation in the next 30 days.

Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move.

Affected products

• Gilacms Gila CMS: up to and including 1.11.4

Published 2019-10-13. Last modified 2026-06-17.