CVE-2020-27387: An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker...

Security readout for executives and security teams

HorizontCMS had a file upload weakness that could let a logged-in user with FileManager access place executable PHP on the server. If abused, this can become server-side code execution and compromise the website. The public record says the vendor patched it, but kept the same 1.0.0-beta version number. Exposure appears limited to HorizontCMS deployments where authenticated users can access FileManager and uploaded storage can execute PHP. Version checks alone are unreliable because the patched release reportedly retained the 1.0.0-beta version string. Treat this as a high-priority remediation if HorizontCMS is deployed, especially on public websites. The issue can lead to website takeover when attacker prerequisites are met, and public exploit references reduce the time defenders can safely delay validation. Mitigation focus: Apply the vendor-patched HorizontCMS code; do not rely on version text alone.; Restrict FileManager access to trusted administrative users only.; Disable PHP execution in upload and storage directories where feasible..

Prepared

Jun 5, 2026, 13:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.