CVE-2020-13384: Monstra

High severity, CVSS 8.8. EPSS: 2.5% chance of exploitation in the next 30 days.

Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048.

Affected products

• Monstra Monstra: version 3.0.4 only

Published 2020-05-22. Last modified 2026-06-17.