{
  "affected": [
    {
      "database_specific": {
        "unresolved_ranges": [
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "1.0.0-alpha2"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "1.0.0-alpha3"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "1.0.0-alpha4"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "1.0.0-alpha5"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "1.0.0-alpha6"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "1.0.0-alpha7"
              }
            ]
          },
          {
            "events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "1.0.0-alpha8"
              }
            ]
          }
        ]
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "436b5ab679fd27afa3d99c023dbe103113da4fee"
            }
          ],
          "repo": "https://github.com/ttimot24/horizont-cms",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "1.0.0-alpha"
              },
              {
                "introduced": "0"
              },
              {
                "last_affected": "1.0.0-beta"
              }
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "59c2843b5df2ac2e78b1d54db4e40dbe082cf233"
            },
            {
              "introduced": "0"
            },
            {
              "last_affected": "5aa34ac4e457a49b83f24a2969593c495f3ed9ad"
            }
          ],
          "repo": "https://github.com/ttimot24/horizontcms",
          "type": "GIT"
        }
      ]
    }
  ],
  "details": "An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager's rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/\u003cphp_file_name\u003e. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta.",
  "id": "CVE-2020-27387",
  "modified": "2026-04-01T23:10:32.362584836Z",
  "published": "2020-11-05T02:15:12.067Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/rapid7/metasploit-framework/pull/14340"
    },
    {
      "type": "FIX",
      "url": "https://blog.vonahi.io/whats-in-a-re-name/"
    },
    {
      "type": "FIX",
      "url": "https://github.com/ttimot24/HorizontCMS/commit/436b5ab679fd27afa3d99c023dbe103113da4fee"
    },
    {
      "type": "EVIDENCE",
      "url": "http://packetstormsecurity.com/files/160046/HorizontCMS-1.0.0-beta-Shell-Upload.html"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}