CVE-2020-27385

Name: CVE-2020-27385
Creator: NVD / NIST
Published: 2020-11-12T19:15:15.113+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.1/10EPSS 1.75%

Last modified Jun 17, 2026

CVE-2020-27385 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. Incorrect Access Control in the FileEditor (/Admin/Views/FileEditor/) in FlexDotnetCMS before v1.5.11 allows an authenticated remote attacker to read and write to existing files outside the web root. The files can be accessed via directory traversal, i.e., by entering a .. EPSS estimates a 1.75% chance of exploitation in the next 30 days.

Description

Incorrect Access Control in the FileEditor (/Admin/Views/FileEditor/) in FlexDotnetCMS before v1.5.11 allows an authenticated remote attacker to read and write to existing files outside the web root. The files can be accessed via directory traversal, i.e., by entering a .. (dot dot) path such as ..\..\..\..\..\<file> in the input field of the FileEditor. In FlexDotnetCMS before v1.5.8, it is also possible to access files by specifying the full path (e.g., C:\<file>). The files can then be edited via the FileEditor.

Metrics

CVSS 3.1

8.1/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS Probability

1.75%

74.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-22

Affected Software

Vendor	Product	Versions
Flexdotnetcms Project	Flexdotnetcms	< 1.5.11

References

https://blog.vonahi.io/whats-in-a-re-name/Exploit, Third Party Advisory
https://github.com/MacdonaldRobinson/FlexDotnetCMS/releases/tag/v1.5.11Release Notes, Third Party Advisory
https://blog.vonahi.io/whats-in-a-re-name/Exploit, Third Party Advisory
https://github.com/MacdonaldRobinson/FlexDotnetCMS/releases/tag/v1.5.11Release Notes, Third Party Advisory

Timeline

Published: Nov 12, 2020
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2020-27385?

How severe is CVE-2020-27385?

CVE-2020-27385 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 1.75% probability of exploitation in the next 30 days.

How do I fix CVE-2020-27385?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-27385?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST