Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2007-5156: Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX

55
This month
HIGH 7.5DOWNGRADEUPGRADEDOWNGRADE

CVE-2007-5156 is a high-severity flaw (CVSS 7.5) affecting cardinal cms, lanai cms, sitex cms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php." and has an unknown extension, which is recognized as a .php file by the Apache HTTP server, a different vulnerability than CVE-2006-0658 and CVE-2006-252

Why this priority

  • High severity
  • EPSS top 5%: very likely to be exploited
  • Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score7.5 (High)
EPSS exploit chance8.0% (top 5%)
CISA exploited listNo
Published2007-10-01
Last modified2026-06-16
Publisher (CNA): MITRE · Vendor: cardinal cms project · redlinesoft · sitex cms project · syntax cms project

Share: LinkedIn · X · Reddit

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

cardinal cms project cardinal cms DOWNGRADE
Affected: 1.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.2
1. Check installed version
apt-cache policy cardinal-cms || rpm -q cardinal-cms || cardinal-cms --version
2. No fixed release: DOWNGRADE to a release before 1.2 (Debian / Ubuntu)
apt-cache madison cardinal-cms sudo apt install cardinal-cms=<VERSION_BEFORE_1.2> sudo apt-mark hold cardinal-cms
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list cardinal-cms sudo dnf downgrade cardinal-cms-<VERSION_BEFORE_1.2> sudo dnf versionlock add cardinal-cms
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redlinesoft lanai cms UPGRADE
Affected: <= 1.2.16
Fixed in: newer than 1.2.16
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy lanai-cms || rpm -q lanai-cms || lanai-cms --version
2. UPGRADE to newer than 1.2.16 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade lanai-cms
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade lanai-cms
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
sitex cms project sitex cms DOWNGRADE
Affected: 0.7.3 beta
Fixed in: no fixed release known
Safe to downgrade to: a release before 0.7.3
1. Check installed version
apt-cache policy sitex-cms || rpm -q sitex-cms || sitex-cms --version
2. No fixed release: DOWNGRADE to a release before 0.7.3 (Debian / Ubuntu)
apt-cache madison sitex-cms sudo apt install sitex-cms=<VERSION_BEFORE_0.7.3> sudo apt-mark hold sitex-cms
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list sitex-cms sudo dnf downgrade sitex-cms-<VERSION_BEFORE_0.7.3> sudo dnf versionlock add sitex-cms
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
syntax cms project syntax cms UPGRADE
Affected: <= 1.3
Fixed in: newer than 1.3
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy syntax-cms || rpm -q syntax-cms || syntax-cms --version
2. UPGRADE to newer than 1.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade syntax-cms
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade syntax-cms
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2007-5156?

cardinal cms: downgrade or apply the listed mitigation; lanai cms: upgrade to newer than 1.2.16; sitex cms: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2007-5156 being exploited?

CVE-2007-5156 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2007-5156 affect?

CVE-2007-5156 affects cardinal cms, lanai cms, sitex cms. Severity is high (CVSS 7.5). Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute a

How urgent is CVE-2007-5156?

Priority 55/100. High severity; EPSS top 5%: very likely to be exploited; Public exploit reference

Software pages

Apache HTTP Server vulnerabilities · PHP vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.