CVE-2020-37009

MedDream PACS Server 6.8.3.751 contains an authenticated remote code execution vulnerability that allows authorized users to upload malicious PHP files. Attackers can exploit the uploadImage.php endpoint by authenticating and uploading a PHP shell to execute arbitrary system commands with elevated privileges.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://meddream.com/products/meddream-pacs-server/
https://www.exploit-db.com/exploits/48853
https://www.vulncheck.com/advisories/meddream-pacs-server-remote-code-execution
https://www.exploit-db.com/exploits/48853

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) MedDream PACS Server 6.8.3.751 contiene una vulnerabilidad de ejecución remota de código autenticada que permite a usuarios autorizados subir archivos PHP maliciosos. Los atacantes pueden explotar el endpoint uploadImage.php autenticándose y subiendo un shell PHP para ejecutar comandos de sistema arbitrarios con privilegios elevados.

29 Jan 2026, 17:16

Type	Values Removed	Values Added
References	~~() https://www.exploit-db.com/exploits/48853 -~~	() https://www.exploit-db.com/exploits/48853 -

29 Jan 2026, 15:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-29 15:16

Updated : 2026-06-17 03:16

NVD link : CVE-2020-37009

Mitre link : CVE-2020-37009

CVE.ORG link : CVE-2020-37009

JSON object : View

Products Affected

No product.

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2020-37009", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2020-37009", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-29T15:49:26.017902Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "MedDream", "product": "MedDream PACS Server", "versions": [{"status": "affected", "version": "6.8.3.751"}]}]}], "published": "2026-01-29T15:16:07.960", "references": [{"url": "https://meddream.com/products/meddream-pacs-server/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/48853", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/meddream-pacs-server-remote-code-execution", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/48853", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "MedDream PACS Server 6.8.3.751 contains an authenticated remote code execution vulnerability that allows authorized users to upload malicious PHP files. Attackers can exploit the uploadImage.php endpoint by authenticating and uploading a PHP shell to execute arbitrary system commands with elevated privileges."}, {"lang": "es", "value": "MedDream PACS Server 6.8.3.751 contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo autenticada que permite a usuarios autorizados subir archivos PHP maliciosos. Los atacantes pueden explotar el endpoint uploadImage.php autentic\u00e1ndose y subiendo un shell PHP para ejecutar comandos de sistema arbitrarios con privilegios elevados."}], "lastModified": "2026-06-17T03:16:44.783", "sourceIdentifier": "disclosure@vulncheck.com"}