CVE-2020-13894: handler/upload_handler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files

Q: How do I fix CVE-2020-13894?

dext5: upgrade to newer than 3.5.1402961. Exact commands for each OS are on this page.

Q: Is CVE-2020-13894 being exploited?

CVE-2020-13894 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2020-13894 affect?

CVE-2020-13894 affects dext5. Severity is high (CVSS 7.5). handler/upload_handler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field.

Q: How urgent is CVE-2020-13894?

Priority 53/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action

This week

HIGH 7.5REMOTEUPGRADE

CVE-2020-13894 is a high-severity flaw (CVSS 7.5) affecting dext5. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

handler/upload_handler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field.

Why this priority

High severity
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.1% (top 34%)
CISA exploited list	No
Weakness	CWE-276
Published	2020-06-07
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: dext5

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2020-06-07 01:15 UTCPublished CVE record published
2026-06-17 02:53 UTCUpdated Record last modified

dext5 dext5 UPGRADE

Affected: <= 3.5.1402961

Fixed in: newer than 3.5.1402961

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy dext5 || rpm -q dext5 || dext5 --version

2. UPGRADE to newer than 3.5.1402961 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade dext5

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade dext5

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-13894?

dext5: upgrade to newer than 3.5.1402961. Exact commands for each OS are on this page.

Is CVE-2020-13894 being exploited?

CVE-2020-13894 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-13894 affect?

CVE-2020-13894 affects dext5. Severity is high (CVSS 7.5). handler/upload_handler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field.

How urgent is CVE-2020-13894?

Priority 53/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action

Related CVEs

CVE-2020-7832 HIGH 8.8 UPGRADE A vulnerability (improper input validation) in the DEXT5 Upload solution allows an unauthenticated attacker to
CVE-2020-13442 CRITICAL 9.8 UPGRADE A Remote code execution vulnerability exists in DEXT5Upload in DEXT5 through 2.7.1402870
CVE-2019-19169 HIGH 7.8 DOWNGRADE Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to
CVE-2019-19168 HIGH 7.8 DOWNGRADE Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to
CVE-2019-19164 HIGH 7.8 DOWNGRADE dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could a

References

← Back to latest CVEs