CVE-2022-23043: Tribalsystems Zenario

High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days.

Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in order to run commands on the server.

Affected products

• Tribalsystems Zenario: version 9.2 only

Published 2022-02-24. Last modified 2026-06-17.