CVE-2022-26607

HighCVSS 7.2

Published: 06/04/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.00%

78th percentile - higher than 78% of all known CVEs

Summary

A remote code execution (RCE) vulnerability in baigo CMS v3.0-alpha-2 allows attackers to execute arbitrary code by uploading a crafted PHP file.

Risk Assessment

An attacker can take over the server, steal data, or install malware, leading to full system compromise.

Recommendation

Immediately update baigo CMS to the latest stable version and implement file type validation during uploads.

Other vulnerabilities in baigo CMS

CVE-2020-20584Medium
A cross-site scripting (XSS) vulnerability was found in baigo CMS v4.0-beta-1. Attackers can inject arbitrary JavaScript or HTML code via the 'post' parameter sent to /public/console/profile/info-submit/.

Original NVD description (English source)

A remote code execution (RCE) vulnerability in baigo CMS v3.0-alpha-2 was discovered to allow attackers to execute arbitrary code via uploading a crafted PHP file.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS