CVE-2020-37071
Published: 03 February 2026
Summary
CVE-2020-37071 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Craftcms (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-37071 is a deserialization vulnerability (CWE-502) affecting the CraftCMS 3 vCard Plugin version 1.0.0. The flaw resides in the plugin's vCard download functionality, where it improperly handles serialized payloads, enabling unauthenticated remote code execution. Assigned a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it was published on 2026-02-03.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity by sending a specially crafted request containing a malicious serialized PHP payload to the vCard download endpoint. Successful exploitation grants arbitrary PHP code execution on the target server, potentially leading to full system compromise, including high confidentiality, integrity, and availability impacts.
Advisories and related resources, such as the VulnCheck advisory and plugin page on CraftCMS, provide details on mitigation, while public exploits are available on Exploit-DB (48492) and GitLab, indicating proof-of-concept code exists for reproduction. Practitioners should consult these references for patch information or upgrade guidance specific to the vCard plugin.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31011
Vulnerability details
CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download…
more
functionality with a specially crafted request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a deserialization flaw in a public-facing web application plugin (CraftCMS vCard), enabling unauthenticated remote code execution, directly mapping to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely identification, reporting, and remediation of the deserialization flaw in the CraftCMS vCard plugin directly prevents unauthenticated remote code execution.
Validating serialized payloads received at the vCard download endpoint ensures malicious inputs are rejected before deserialization occurs.
Boundary protection with web application firewalls monitors and blocks crafted requests containing malicious serialized payloads targeting the vulnerable endpoint.