CVE-2020-37071: Craft CMS Craftcms

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download functionality with a specially crafted request.

Affected products

Published 2026-02-03. Last modified 2026-06-17.