CVE-2008-2267 — Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/

Back Back to CVE browser

HIGH

Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/

Published May 16, 2008

7.5

HIGH

CVSS 2.0

EPSS 4.81%

Description

Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/.

Affected products

Remediation

No remediation recorded yet.

Metrics

4.81% 0.04808

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.04808

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (14 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	4.81% (0.04808)	91.68th	v5 (v2026.06.15)
Jun 15, 2026	4.81% (0.04808)	90.79th	v5 (v2026.06.15)
Apr 23, 2026	11.24% (0.11235)	93.55th	v4 (v2025.03.14)
Nov 29, 2025	10.22% (0.10220)	92.86th	v4 (v2025.03.14)
Jul 6, 2025	12.17% (0.12174)	93.50th	v4 (v2025.03.14)
Mar 30, 2025	7.86% (0.07861)	91.20th	v4 (v2025.03.14)
Mar 29, 2025	13.97% (0.13974)	90.56th	v4 (v2025.03.14)
Mar 17, 2025	7.86% (0.07861)	91.39th	v4 (v2025.03.14)
Jan 3, 2025	24.31% (0.24313)	96.64th	v3 (v2023.03.01)
Dec 17, 2024	26.09% (0.26090)	96.73th	v3 (v2023.03.01)
Mar 7, 2023	13.71% (0.13709)	94.69th	v3 (v2023.03.01)
Mar 6, 2023	15.61% (0.15607)	96.08th	v2 (v2022.01.01)
Apr 1, 2022	15.61% (0.15607)	95.72th	v2 (v2022.01.01)
Feb 4, 2022	15.61% (0.15607)	92.63th	v2 (v2022.01.01)

Weaknesses (1)

CWE-20

Improper Input Validation

References (6)

http://blog.cmsmadesimple.org/2008/05/12/announcing-cms-made-simple-125/
x_refsource_CONFIRM
http://secunia.com/advisories/30208
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.attrition.org/pipermail/vim/2008-May/001978.html
mailing-listx_refsource_VIM
http://www.securityfocus.com/bid/29170
vdb-entryx_refsource_BIDExploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/42371
vdb-entryx_refsource_XF
https://www.exploit-db.com/exploits/5600
exploitx_refsource_EXPLOIT-DB

Link	Providers	Tags
http://blog.cmsmadesimple.org/2008/05/12/announcing-cms-made-simple-125/		x_refsource_CONFIRM
http://secunia.com/advisories/30208		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.attrition.org/pipermail/vim/2008-May/001978.html		mailing-listx_refsource_VIM
http://www.securityfocus.com/bid/29170		vdb-entryx_refsource_BIDExploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/42371		vdb-entryx_refsource_XF
https://www.exploit-db.com/exploits/5600		exploitx_refsource_EXPLOIT-DB

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published May 16, 2008

Updated Aug 7, 2024

Reserved May 16, 2008

Link CVE-2008-2267

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2008-2267

Red Hat

Severity n/a

Public date n/a

Links CVE-2008-2267