TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious PHP files…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 10, 2026 · NIST NVD

   Detected

   TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious PHP files through the file upload functionality. Attackers can upload a PHP shell via the Files section in the content area and execute commands by accessing the uploaded file at /textpattern/files/ with GET parameters passed to the system fu

2. Jul 25, 2026 · NIST NVD

   Updated

   TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious PHP files through the file upload functionality. Attackers can upload a PHP shell via the Files section in the content area and execute commands by accessing the uploaded file at /textpattern/files/ with GET parameters passed to the system fu

Sources

• CVE.orgVulnerability recordCVE-2021-47943

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2021-47943

  TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious PHP files through the file upload functionality. Attackers can upload a PHP shell via the Files section in the content are

  nvd.nist.gov

References

• Reference · exploit-db.com
• Reference · exploit-db.com
• Reference · vulncheck.com