CVE-2021-28931: Fork-CMS Fork CMS

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file uploaded to the Themes panel.

Affected products

• Fork-CMS Fork CMS: version 5.9.2 only

Published 2021-07-07. Last modified 2026-06-17.