CVE-2020-21005: WellCMS 2.0 beta3 is vulnerable to File Upload.

Security readout for executives and security teams

WellCMS 2.0 beta3 reportedly lets a logged-in CMS user manipulate an image upload so the server accepts a webshell. That can turn a content-management account into server control if the uploaded file executes. Public evidence is sparse and does not name a patch or active exploitation. Exposure is likely limited to organizations running WellCMS 2.0 beta3, especially where the CMS background is internet-accessible or available to untrusted users. The source bundle lists affected vendor/product metadata as n/a, so confirm product identity and version directly. Prioritize if WellCMS 2.0 beta3 is deployed or if CMS accounts are shared with non-administrators. The business risk is server compromise from a routine upload feature, but urgency depends on confirmed exposure because public evidence is incomplete. Mitigation focus: Check WellCMS vendor guidance for an upgrade, patch, or supported workaround.; Restrict CMS background access to trusted administrators and trusted networks.; Prevent execution of uploaded files in upload directories..

Prepared

Jun 2, 2026, 19:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.