CVE-2017-16903
CriticalSummary
LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter, in conjunction with PHP code in the content parameter, within a template Style add request to index.php.
Risk Assessment
An attacker can exploit this vulnerability to execute remote code, potentially leading to system takeover and access to sensitive data.
Recommendation
It is recommended to update LvyeCMS to the latest version and implement appropriate security measures against directory traversal attacks.
Original NVD description (English source)
LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter, in conjunction with PHP code in the content parameter, within a template Style add request to index.php.