What’s Vulnerable › Vulnerabilities

CVE-2021-47900: Gila CMS < 2.0.0 - Remote Code Execution

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-27 · updated 2026-06-17
• Weakness: CWE-98

Description

Gila CMS versions prior to 2.0.0 contain a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through manipulated HTTP headers. Attackers can inject PHP code in the User-Agent header with shell_exec() to run system commands by sending crafted requests to the admin endpoint.

Affected products

• Gila CMS: before 2.0.0 — fixed in 2.0.0

How to fix

Upgrade to a fixed version: Gila CMS 2.0.0. Check the vendor advisory for mitigations.

References

• https://gilacms.com/
• https://github.com/GilaCMS/gila
• https://www.exploit-db.com/exploits/49412
• https://www.vulncheck.com/advisories/gila-cms-remote-code-execution

Get alerted when CVE-2021-47900 or the next vulnerability affects your stack