CVE-2020-26804

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-11-12 · updated 2026-06-17
Weakness: CWE-434

Description

In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab. Also, in this page, users can upload attachments with the shared announcements. This "Upload Attachment" functionality is suffered from "Unrestricted File Upload" vulnerability so attacker can upload malicious files using this functionality and control the server.

Affected products

Sentrifugo: 3.2

References

https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated.html
https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated.html

Get alerted when CVE-2020-26804 or the next vulnerability affects your stack