CVE-2020-9280

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is installed and enabled by default on the Common Web Platform (CWP). The vulnerability only affects files uploaded after an upgrade to 4.x.

• CWE-434

• https://forum.silverstripe.org/c/releasesVendor Advisory
• https://www.silverstripe.org/download/security-releases/Vendor Advisory
• https://www.silverstripe.org/download/security-releases/cve-2020-9280Vendor Advisory
• https://forum.silverstripe.org/c/releasesVendor Advisory
• https://www.silverstripe.org/download/security-releases/Vendor Advisory
• https://www.silverstripe.org/download/security-releases/cve-2020-9280Vendor Advisory

Published

Apr 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9274An issue was discovered in Pure-FTPd 1.0.49. An uninitialize…7.5
• CVE-2020-9275An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devi…9.8
• CVE-2020-9276An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devi…8.8
• CVE-2020-9277An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devi…9.8
• CVE-2020-9278An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devi…9.1
• CVE-2020-9279An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devi…9.8
• CVE-2020-9281A cross-site scripting (XSS) vulnerability in the HTML Data …6.1
• CVE-2020-9282In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19…6.5
• CVE-2020-9283golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f697…7.5
• CVE-2020-9285Some versions of Sonos One (1st and 2nd generation) allow pa…6.8
• CVE-2020-9286An improper authorization vulnerability in FortiADC may allo…6.5
• CVE-2020-9287An Unsafe Search Path vulnerability in FortiClient EMS onlin…7.8