CVE-2020-25790: Typesettercms Typesetter

High severity, CVSS 7.2. EPSS: 15.6% chance of exploitation in the next 30 days.

Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered trustworthy"; however, the behavior "contradicts our security policy" and is being fixed for 5.2

Affected products

• Typesettercms Typesetter: from 5.0, up to and including 5.1

Published 2020-09-19. Last modified 2026-06-17.