CVE-2020-37071
Published: 03 February 2026
Description
CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download…
more
functionality with a specially crafted request.
Mitigating Controls (NIST 800-53 r5)AI
Timely identification, reporting, and remediation of the deserialization flaw in the CraftCMS vCard plugin directly prevents unauthenticated remote code execution.
Validating serialized payloads received at the vCard download endpoint ensures malicious inputs are rejected before deserialization occurs.
Boundary protection with web application firewalls monitors and blocks crafted requests containing malicious serialized payloads targeting the vulnerable endpoint.
Security SummaryAI
CVE-2020-37071 is a deserialization vulnerability (CWE-502) affecting the CraftCMS 3 vCard Plugin version 1.0.0. The flaw resides in the plugin's vCard download functionality, where it improperly handles serialized payloads, enabling unauthenticated remote code execution. Assigned a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it was published on 2026-02-03.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity by sending a specially crafted request containing a malicious serialized PHP payload to the vCard download endpoint. Successful exploitation grants arbitrary PHP code execution on the target server, potentially leading to full system compromise, including high confidentiality, integrity, and availability impacts.
Advisories and related resources, such as the VulnCheck advisory and plugin page on CraftCMS, provide details on mitigation, while public exploits are available on Exploit-DB (48492) and GitLab, indicating proof-of-concept code exists for reproduction. Practitioners should consult these references for patch information or upgrade guidance specific to the vCard plugin.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a deserialization flaw in a public-facing web application plugin (CraftCMS vCard), enabling unauthenticated remote code execution, directly mapping to exploitation of public-facing applications.