CVE-2021-47943

HIGH 8.8

TextPattern CMS 4.8.7 Remote Code Execution via File Upload

CVSS Score

8.8

EPSS Score

0.2%

EPSS Percentile

47th

TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious PHP files through the file upload functionality. Attackers can upload a PHP shell via the Files section in the content area and execute commands by accessing the uploaded file at /textpattern/files/ with GET parameters passed to the system function.

CWE	CWE-434
Vendor	textpattern
Product	textpattern cms
Published	May 10, 2026
Last Updated	May 11, 2026

Stay Ahead of the Next One

Get instant alerts for textpattern textpattern cms

Be the first to know when new high vulnerabilities affecting textpattern textpattern cms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Textpattern / TextPattern CMS

4.8.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

exploit-db.com: https://www.exploit-db.com/exploits/49996 exploit-db.com: https://www.exploit-db.com/exploits/50415 vulncheck.com: https://www.vulncheck.com/advisories/textpattern-cms-remote-code-execution-via-file-upload

Credits

Mert Daş [email protected]