CVE-2021-47964

High

Published: 15/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Schlix CMS version 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious extension packages through the block manager. Attackers can upload a crafted ZIP file containing PHP code in the packageinfo.inc file and trigger execution by accessing the About tab of the installed extension.

Risk Assessment

This vulnerability poses a serious risk to organizations as it allows attackers to execute arbitrary code on the server, potentially leading to system takeover or data leakage.

Recommendation

It is recommended to update Schlix CMS to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Other vulnerabilities in Schlix CMS 2.2.6-6

CVE-2025-67443Medium
Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS). Due to lack of javascript sanitization in the login form, incorrect login attempts in logs are triggered as XSS in the admin panel.

Original NVD description (English source)

Schlix CMS 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious extension packages through the block manager. Attackers can upload a crafted ZIP file containing PHP code in the packageinfo.inc file and trigger execution by accessing the About tab of the installed extension.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS