High severity8.8NVD Advisory· Published Jun 5, 2017· Updated May 13, 2026
CVE-2017-9442
CVE-2017-9442
Description
BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/bigtreecms/BigTree-CMS/issues/291nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.