CVE-2013-1668: The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute...

Security readout for executives and security teams

CVE-2013-1668 is an OS command injection issue in CosCMS before version 1.822. An authenticated remote administrator could upload a file with a specially crafted filename that causes server commands to run. This is most urgent for organizations still running old CosCMS installations, especially if administrator access is exposed or weakly protected. Exposure is likely limited to legacy CosCMS deployments before 1.822 where administrative upload functionality is reachable. The attacker must be a remote administrator, so risk rises sharply if admin credentials are shared, phished, reused, or exposed to the internet. Treat this as a high-priority legacy application issue if CosCMS is present. Arbitrary command execution can lead to full server compromise, but the known access requirement is administrator-level, so prioritize exposed or poorly controlled admin panels first. Mitigation focus: Upgrade CosCMS to version 1.822 or later where applicable.; Review vendor release notes and the referenced commit for the confirmed correction.; Restrict administrative access to trusted networks and users..

Prepared

Jun 14, 2026, 07:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.