CVE-2021-47900: Gila CMS

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Gila CMS versions prior to 2.0.0 contain a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through manipulated HTTP headers. Attackers can inject PHP code in the User-Agent header with shell_exec() to run system commands by sending crafted requests to the admin endpoint.

Affected products

• Gila CMS Gila CMS: before 2.0.0 (fixed in 2.0.0)

Published 2026-01-27. Last modified 2026-06-17.