CVE-2022-40048
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function. An attacker can upload a malicious file, leading to arbitrary code execution on the server.
Risk Assessment
The risk for the organization includes full server compromise, data theft, or further attacks on the infrastructure.
Recommendation
It is recommended to immediately update Flatpress to the latest version and restrict file upload permissions to trusted users only.
Other vulnerabilities in Flatpress
See all- CVE-2026-56785High
FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields.
- CVE-2022-40047Medium
Flatpress v1.2.1 was discovered to contain a reflected XSS vulnerability via the 'page' parameter in admin.php. An attacker can inject malicious JavaScript code that executes in the victim's browser.
Original NVD description (English source)
Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function.