CVE-2021-36547: Mara CMS Project Mara CMS

Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days.

A remote code execution (RCE) vulnerability in the component /codebase/dir.php?type=filenew of Mara v7.5 allows attackers to execute arbitrary commands via a crafted PHP file.

Affected products

• Mara CMS Project Mara CMS: version 7.5 only

Published 2021-10-28. Last modified 2026-06-17.