PatchTheCVECVE-2020-11766: sendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX Enterprise Web Interface before 0.2.5 allows authenticat
51
This month
HIGH 8.8UPGRADEUPGRADE
CVE-2020-11766 is a high-severity flaw (CVSS 8.8) affecting hylafax, avantfax. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
sendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX Enterprise Web Interface before 0.2.5 allows authenticated Command Injection.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 1.8% (top 21%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2020-05-19 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
ifax hylafax UPGRADE
Affected: >= 0.2.0 and < 0.2.5
Fixed in: 0.2.5
Safe to downgrade to: a release before 0.2.0
1. Check installed version
apt-cache policy hylafax || rpm -q hylafax || hylafax --version
2. UPGRADE to 0.2.5 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade hylafax
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade hylafax
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 0.2.0 (Debian / Ubuntu)
apt-cache madison hylafax
sudo apt install hylafax=<VERSION_BEFORE_0.2.0>
sudo apt-mark hold hylafax
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list hylafax
sudo dnf downgrade hylafax-<VERSION_BEFORE_0.2.0>
sudo dnf versionlock add hylafax
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
avantfax avantfax UPGRADE
Affected: >= 3.3.0 and < 3.3.6
Fixed in: 3.3.6
Safe to downgrade to: a release before 3.3.0
1. Check installed version
apt-cache policy avantfax || rpm -q avantfax || avantfax --version
2. UPGRADE to 3.3.6 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade avantfax
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade avantfax
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 3.3.0 (Debian / Ubuntu)
apt-cache madison avantfax
sudo apt install avantfax=<VERSION_BEFORE_3.3.0>
sudo apt-mark hold avantfax
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list avantfax
sudo dnf downgrade avantfax-<VERSION_BEFORE_3.3.0>
sudo dnf versionlock add avantfax
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-11766?
hylafax: upgrade to 0.2.5; avantfax: upgrade to 3.3.6. Exact commands for each OS are on this page.
Is CVE-2020-11766 being exploited?
CVE-2020-11766 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-11766 affect?
CVE-2020-11766 affects hylafax, avantfax. Severity is high (CVSS 8.8). sendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX Enterprise Web Interface before 0.2.5 allows authenticated Command Injection.
How urgent is CVE-2020-11766?
Priority 51/100. High severity
Software pages
Related CVEs
- CVE-2025-1782 CRITICAL 9.9 UPGRADE UPGRADE In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before
- CVE-2018-17141 CRITICAL 9.8 MITIGATE DOWNGRADE HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that p
- CVE-2005-3539 HIGH 7.5 DOWNGRADE Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitra
- CVE-2005-3538 HIGH 7.5 DOWNGRADE hfaxd in HylaFAX 4.2.3, when PAM support is disabled, accepts arbitrary passwords, which allows remote attacke
- CVE-2005-3070 LOW 3.6 UPGRADE HylaFax 4.2.1 and earlier does not create or verify ownership of the UNIX domain socket, which might allow loc