CVE-2020-26804: Sapplica Sentrifugo

High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days.

In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab. Also, in this page, users can upload attachments with the shared announcements. This "Upload Attachment" functionality is suffered from "Unrestricted File Upload" vulnerability so attacker can upload malicious files using this functionality and control the server.

Affected products

• Sapplica Sentrifugo: version 3.2 only

Published 2020-11-12. Last modified 2026-06-17.