What’s Vulnerable › Vulnerabilities

CVE-2020-15227: Remote Code Execution vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 34.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-10-01 · updated 2026-06-17
• Weakness: CWE-74

Description

Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.

Affected products

• Debian Linux: 9.0
• nette application: from 2.0.0 before 2.0.19; from 2.1.0 before 2.1.13; from 2.2.0 before 2.2.10; from 2.3.0 before 2.3.14; from 2.4.0 before 2.4.16; from 3.0.0 before 3.0.6 — fixed in 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6

How to fix

Upgrade to a fixed version: nette application 2.0.19, 2.1.13, 2.2.10, 2.3.14. Check the vendor advisory for mitigations.

References

• https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94
• https://lists.debian.org/debian-lts-announce/2021/04/msg00003.html
• https://packagist.org/packages/nette/application
• https://packagist.org/packages/nette/nette
• https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94
• https://lists.debian.org/debian-lts-announce/2021/04/msg00003.html
• https://packagist.org/packages/nette/application
• https://packagist.org/packages/nette/nette

Get alerted when CVE-2020-15227 or the next vulnerability affects your stack