What is the CVSS score of CVE-2020-37186?

CVE-2020-37186 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of PHP are affected by CVE-2020-37186?

Chevereto 3.13.4 installations face critical remote code execution risk during database setup, allowing attackers to gain complete system control.

Is there a public PoC exploit available for CVE-2020-37186?

Yes, a public proof-of-concept exploit is available for CVE-2020-37186. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2020-37186?

Within 24 hours: Identify all Chevereto 3.13.4 instances in production and development; isolate from untrusted networks; disable external access to installation/setup pages. Within 7 days: Upgrade to Chevereto 3.13.5 or later (if available from vendor), or migrate to alternative image hosting platform if upgrade path blocked. Within 30 days: Complete migration off vulnerable version; implement post-incident code review for any database setup processes; deploy WAF rules to block database configuration endpoints.

PHP CVE-2020-37186

CRITICAL

Code Injection (CWE-94)

2026-02-11 disclosure@vulncheck.com

PHP RCE

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 12, 2026 - 15:10 vuln.today

Public exploit code

CVE Published

Feb 11, 2026 - 21:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Chevereto 3.13.4 Core contains a remote code execution vulnerability that allows attackers to inject malicious code during database configuration installation. Attackers can manipulate the database table prefix parameter to write a PHP shell file and execute arbitrary system commands through a crafted POST request.

AnalysisAI

RCE in Chevereto 3.13.4 image hosting via code injection during database configuration. Allows injecting code during installation/setup. PoC available.