CVE-2021-40189: PHP-Fusion Phpfusion

High severity, CVSS 7.2. EPSS: 1.8% chance of exploitation in the next 30 days.

PHPFusion 9.03.110 is affected by a remote code execution vulnerability. The theme function will extract a file to "webroot/themes/{Theme Folder], where an attacker can access and execute arbitrary code.

Affected products

• PHP-Fusion Phpfusion: version 9.03.110 only

Published 2021-10-11. Last modified 2026-06-17.