Remote code execution in nette application
Priority HIGH 67CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.
Why it matters now
EPSS 0.34424 98th percentileScored 2026-11-07
Fix Fixed application (nette): 2.0.19, 2.1.13, 2.2.10 +3nette/application (Packagist): 2.2.10, 2.3.14, 2.4.16 +3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nette | application | 2.0.0 to before 2.0.19; 2.1.0 to before 2.1.13; 2.2.0 to before 2.2.10; 2.3.0 to before 2.3.14; 2.4.0 to before 2.4.16; 3.0.0 to before 3.0.6 | 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 | Patch available | CNA |
| — | nette/application (Packagist) | 2.2.0 to before 2.2.10 | 2.2.10 | Patch available | GHSA-8gv3-3j7f-wg94 |
| — | nette/application (Packagist) | 2.3.0 to before 2.3.14 | 2.3.14 | Patch available | GHSA-8gv3-3j7f-wg94 |
| — | nette/application (Packagist) | 2.4.0 to before 2.4.16 | 2.4.16 | Patch available | GHSA-8gv3-3j7f-wg94 |
| — | nette/application (Packagist) | 3.0.0 to before 3.0.6 | 3.0.6 | Patch available | GHSA-8gv3-3j7f-wg94 |
| — | nette/application (Packagist) | 2.0.0 to before 2.0.19 | 2.0.19 | Patch available | GHSA-8gv3-3j7f-wg94 |
| — | nette/application (Packagist) | 2.1.0 to before 2.1.13 | 2.1.13 | Patch available | GHSA-8gv3-3j7f-wg94 |
- application Vendornette Affected 2.0.0 to before 2.0.19; 2.1.0 to before 2.1.13; 2.2.0 to before 2.2.10; 2.3.0 to before 2.3.14; 2.4.0 to before 2.4.16; 3.0.0 to before 3.0.6 Fixed in 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 Patch available CNA
- nette/application (Packagist) Vendor— Affected 2.2.0 to before 2.2.10 Fixed in 2.2.10 Patch available GHSA-8gv3-3j7f-wg94
- nette/application (Packagist) Vendor— Affected 2.3.0 to before 2.3.14 Fixed in 2.3.14 Patch available GHSA-8gv3-3j7f-wg94
- nette/application (Packagist) Vendor— Affected 2.4.0 to before 2.4.16 Fixed in 2.4.16 Patch available GHSA-8gv3-3j7f-wg94
- nette/application (Packagist) Vendor— Affected 3.0.0 to before 3.0.6 Fixed in 3.0.6 Patch available GHSA-8gv3-3j7f-wg94
- nette/application (Packagist) Vendor— Affected 2.0.0 to before 2.0.19 Fixed in 2.0.19 Patch available GHSA-8gv3-3j7f-wg94
- nette/application (Packagist) Vendor— Affected 2.1.0 to before 2.1.13 Fixed in 2.1.13 Patch available GHSA-8gv3-3j7f-wg94
CPE configurations NVD · 2
Remediation
- Fix · CNA application (nette) Fixed in 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6
- Fix · GHSA-8gv3-3j7f-wg94 nette/application (Packagist) Fixed in 2.2.10 Advisory →
- Fix · GHSA-8gv3-3j7f-wg94 nette/application (Packagist) Fixed in 2.3.14 Advisory →
- Fix · GHSA-8gv3-3j7f-wg94 nette/application (Packagist) Fixed in 2.4.16 Advisory →
- Fix · GHSA-8gv3-3j7f-wg94 nette/application (Packagist) Fixed in 3.0.6 Advisory →
- Fix · GHSA-8gv3-3j7f-wg94 nette/application (Packagist) Fixed in 2.0.19 Advisory →
- Fix · GHSA-8gv3-3j7f-wg94 nette/application (Packagist) Fixed in 2.1.13 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15227
- 2026-10-03 Alias added: GHSA-8gv3-3j7f-wg94
References
Advisory 5
Sources
- CVE-2020-15227 · CVE Program
- CVE-2020-15227 · NVD
- FIRST EPSS
- GHSA-8gv3-3j7f-wg94 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-15227 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences