CVE-2020-25790: Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file insid...

Security readout for executives and security teams

CVE-2020-25790 affects Typesetter CMS 5.x through 5.1. An administrator can place a PHP file inside a ZIP archive and have the CMS upload path allow code execution. This is most urgent where admin accounts are exposed, shared, weakly protected, or could be phished. The vendor disputed severity because admins are trusted, but acknowledged the behavior conflicted with policy. Exposure is limited to organizations running Typesetter CMS 5.x through 5.1, especially where administrative upload features are enabled. Risk increases when the admin interface is internet-accessible, lacks strong authentication, or has multiple delegated administrators. Treat this as a targeted exposure review rather than broad internet worm risk. Prioritize any externally managed Typesetter CMS site, especially if admin access controls are weak or the CMS runs on important hosting infrastructure. Mitigation focus: Inventory Typesetter CMS deployments and identify versions 5.x through 5.1.; Restrict CMS administrator access to trusted users and protected networks.; Review or disable ZIP-based upload workflows until vendor guidance is applied..

Prepared

Jun 5, 2026, 14:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.