CVE-2016-7902

Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authenticated users with permissions to manage media items to execute arbitrary code by uploading a ZIP file containing a file with a crafted extension, as demonstrated by .php.txt or .php%20.

• CWE-434

• http://www.openwall.com/lists/oss-security/2016/10/05/6Mailing List
• http://www.securityfocus.com/bid/93440
• https://dotclear.org/blog/post/2016/11/01/Dotclear-2.10.3Patch, Vendor Advisory
• https://hg.dotclear.org/dotclear/rev/a9db771a5a70Patch
• http://www.openwall.com/lists/oss-security/2016/10/05/6Mailing List
• http://www.securityfocus.com/bid/93440
• https://dotclear.org/blog/post/2016/11/01/Dotclear-2.10.3Patch, Vendor Advisory
• https://hg.dotclear.org/dotclear/rev/a9db771a5a70Patch

Published

Jan 4, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-7896Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-7897Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-7898Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-7899Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-7900Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-7901Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-7903Dotclear before 2.10.3, when the Host header is not part of …
• CVE-2016-7904Cross-site request forgery (CSRF) vulnerability in CMS Made …
• CVE-2016-7905The read_gab2_sub function in libavformat/avidec.c in FFmpeg…
• CVE-2016-7906magick/attribute.c in ImageMagick 7.0.3-2 allows remote atta…5.5
• CVE-2016-7907The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka …4.4
• CVE-2016-7908The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka …4.4