CVE-2015-8832

8.8 highEPSS 2.6%

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a (1) .pht, (2) .phps, or (3) .phtml extension.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2017-02-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dotclear:dotclear

References

http://dotclear.org/blog/post/2015/10/25/Dotclear-2.8.2
http://packetstormsecurity.com/files/134352/dotclear-2.8.1-Shell-Upload.html
http://seclists.org/fulldisclosure/2015/Nov/58
http://www.openwall.com/lists/oss-security/2016/03/05/4
http://www.openwall.com/lists/oss-security/2016/03/07/5

Check your stack JSON