LeptonCMS Arbitrary File Upload Vulnerability in Version 7.3.0

An arbitrary file upload vulnerability has been identified in LeptonCMS version 7.3.0. This issue arises from inadequate validation of uploaded files, allowing authenticated attackers to upload specially crafted ZIP/PHP files that could execute arbitrary code.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution on the server.

Reproduction

To reproduce this vulnerability, an authenticated user can upload a ZIP file containing a PHP script to the application. The lack of proper file validation will allow the PHP script to be executed on the server, leading to arbitrary code execution.