CVE-2020-13443

ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft actions. A user with low privileges (member) is able to upload this. It is possible to bypass the MIME type check and file-extension check while uploading new files. Short aliases are not used for an attachment; instead, direct access is allowed to the uploaded files. It is possible to upload PHP only if one has member access, or registration/forum is enabled and one can create a member with the default group id of 5. To exploit this, one must to be able to send and compose messages (at least).

• CWE-434

• https://expressionengine.com/blogVendor Advisory
• https://gist.github.com/mariuszpoplwski/51604d8a6d7d78fffdf590c25e844e09Exploit, Third Party Advisory
• https://expressionengine.com/blogVendor Advisory
• https://gist.github.com/mariuszpoplwski/51604d8a6d7d78fffdf590c25e844e09Exploit, Third Party Advisory

Published

Jun 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13435SQLite through 3.32.0 has a segmentation fault in sqlite3Exp…5.5
• CVE-2020-13438ffjpeg through 2020-02-24 has an invalid read in jfif_encode…6.5
• CVE-2020-13439ffjpeg through 2020-02-24 has a heap-based buffer over-read …6.5
• CVE-2020-1344An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2020-13440ffjpeg through 2020-02-24 has an invalid write in bmp_load i…6.5
• CVE-2020-13442A Remote code execution vulnerability exists in DEXT5Upload …9.8
• CVE-2020-13444Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before …6.5
• CVE-2020-13445In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fi…8.8
• CVE-2020-13448QuickBox Community Edition through 2.5.5 and Pro Edition thr…8.8
• CVE-2020-13449A directory traversal vulnerability in the Markdown engine o…7.5
• CVE-2020-1345<p>A cross-site-scripting (XSS) vulnerability exists when Mi…7.4
• CVE-2020-13450A directory traversal vulnerability in file upload function …9.8