CVE-2020-7246: Qdpm

High severity, CVSS 8.8. EPSS: 83.2% chance of exploitation in the next 30 days.

A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.

Affected products

• Qdpm Qdpm: up to and including 9.1

Published 2020-01-21. Last modified 2026-06-17.