PowerCMS Path Traversal Vulnerability in Backup Restore Feature Allowing Arbitrary Code Execution

A path traversal vulnerability has been identified in the backup and restore feature of PowerCMS. This issue affects PowerCMS versions 6.7 and earlier (6.x series), 5.3 and earlier (5.x series), and 4.6 and earlier (4.x series). The vulnerability allows a product administrator to execute arbitrary code by restoring a crafted backup file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where PowerCMS is running, executed in the context of the application.

Remediation

Users are advised to update PowerCMS to the latest version. Instructions for updating can be found on the PowerCMS website.