CVE-2020-11467: Deskpro

High severity, CVSS 7.2. EPSS: 4% chance of exploitation in the next 30 days.

An issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify the helpdesk interface by editing /portal/api/style/edit-theme-set/template-sources theme templates, and uses TWIG as its template engine. While direct access to self and _self variables was not permitted, one could abuse the accessible variables in one's context to reach a native unserialize function via the code parameter. There, on could pass a crafted payload to trigger a set of POP gadgets in order to achieve remote code execution.

Affected products

• Deskpro Deskpro: before 2019.8.0 (fixed in 2019.8.0)

Published 2020-04-01. Last modified 2026-06-17.