PatchTheCVECVE-2020-15189: SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload
CVE-2020-15189 is a medium-severity flaw (CVSS 6.8) affecting soy cms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload. Cross-Site Scripting(XSS) vulnerability that was used in CVE-2020-15183 can be used to increase impact by redirecting the administrator to access a specially crafted page. This vulnerability is caused by insecure configuration in elFinder. This is fixed in version 3.0.2.328.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.8 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | Required |
| EPSS exploit chance | 2.8% (top 14%) |
| CISA exploited list | No |
| Weakness | CWE-434 |
| Published | 2020-09-18 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-15189?
soy cms: upgrade to 3.0.2.328. Exact commands for each OS are on this page.
Is CVE-2020-15189 being exploited?
CVE-2020-15189 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-15189 affect?
CVE-2020-15189 affects soy cms. Severity is medium (CVSS 6.8). SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload. Cross-Site Scripting(XSS) vulnerability that was used in CVE-2020-15183 can be used to increase impact by redirecting the administrator to
How urgent is CVE-2020-15189?
Priority 50/100. Public exploit reference
Related CVEs
- CVE-2024-28187 HIGH 7.2 UPGRADE SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops
- CVE-2020-15188 CRITICAL 10.0 UPGRADE SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE)
- CVE-2020-15182 HIGH 8.4 UPGRADE UPGRADE The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery (CSRF) and Remote Code Executio
- CVE-2019-11376 HIGH 7.2 DOWNGRADE SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a <?php substring in the second text
- CVE-2017-2164 MEDIUM 6.1 UPGRADE Cross-site scripting vulnerability in SOY CMS with installer 1.8.12 and earlier allows remote attackers to inj