CVE-2020-37186: Chevereto 3.13.4 Core RCE Vulnerability

CVE-2020-37186 Overview

CVE-2020-37186 is a critical remote code execution (RCE) vulnerability affecting Chevereto 3.13.4 Core, a popular self-hosted image hosting software. This vulnerability allows unauthenticated attackers to inject malicious code during the database configuration installation phase. By manipulating the database table prefix parameter, attackers can write a PHP shell file to the web server and execute arbitrary system commands through a specially crafted POST request.

Critical Impact

Unauthenticated attackers can achieve complete server compromise by exploiting the installation wizard to inject PHP code via the database table prefix parameter, leading to arbitrary command execution on the underlying system.

Affected Products

• Chevereto 3.13.4 Core
• Chevereto-Free (versions prior to security patch)
• Self-hosted Chevereto installations with exposed installation wizards

Discovery Timeline

• 2026-02-11 - CVE-2020-37186 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2020-37186

Vulnerability Analysis

This vulnerability is classified as Code Injection (CWE-94) and enables remote code execution through the Chevereto installation process. The flaw exists in the database configuration handler, which fails to properly sanitize user-supplied input for the database table prefix parameter.

When an attacker submits a malicious payload through the installation wizard's POST request, the unsanitized table prefix value is written directly into a PHP configuration file. This allows attackers to break out of the intended string context and inject arbitrary PHP code, including web shells that provide persistent remote access to the compromised server.

The attack surface is particularly dangerous because it targets the installation phase, which is often left exposed on misconfigured servers or during initial deployment. Once exploited, attackers gain the ability to execute system commands with the privileges of the web server process, potentially leading to full server compromise.

Root Cause

The root cause of this vulnerability is improper input validation and insufficient output encoding in the database configuration installation routine. The application accepts the database table prefix parameter from user input and incorporates it into generated PHP code without proper sanitization or escaping. This allows attackers to inject malicious PHP statements that are then executed when the configuration file is processed by the web server.

Attack Vector

The attack is conducted over the network and requires no authentication or user interaction. An attacker identifies a Chevereto installation with an accessible installation wizard (typically at /install or similar paths). By sending a crafted POST request to the database configuration endpoint with a malicious table prefix value, the attacker can inject PHP code that creates a web shell or executes arbitrary commands.

The exploitation flow involves:

1. Identifying a vulnerable Chevereto instance with an exposed installation wizard
2. Crafting a POST request with a malicious database table prefix containing PHP code
3. Submitting the request to write the malicious code to a PHP file
4. Accessing the injected shell to execute arbitrary system commands

For detailed technical analysis and proof-of-concept information, refer to the Exploit-DB #47903 advisory and the VulnCheck Chevereto Advisory.

Detection Methods for CVE-2020-37186

Indicators of Compromise

• Unexpected PHP files appearing in web directories, particularly with names suggesting shells (e.g., shell.php, cmd.php, random alphanumeric names)
• Web server logs showing POST requests to /install paths with abnormal or encoded payloads in table prefix parameters
• Configuration files containing unusual PHP code or escape sequences outside expected patterns
• Outbound network connections initiated by the web server process to unknown destinations

Detection Strategies

• Monitor web server access logs for requests to installation endpoints (/install, /setup) on production systems where installation should be complete
• Implement file integrity monitoring (FIM) on Chevereto installation directories to detect unauthorized file modifications
• Deploy web application firewalls (WAF) with rules to detect PHP code injection patterns in POST request parameters
• Use SentinelOne Singularity to detect and block suspicious PHP process behaviors and web shell activity

Monitoring Recommendations

• Configure alerts for any access attempts to installation wizard URLs on production Chevereto instances
• Implement real-time monitoring of the web server process for spawning unexpected child processes (common indicator of web shell execution)
• Enable verbose logging for PHP applications and monitor for configuration file writes during unexpected timeframes

How to Mitigate CVE-2020-37186

Immediate Actions Required

• Remove or restrict access to the Chevereto installation directory immediately after completing initial setup
• Update Chevereto to the latest available version with security patches applied
• Conduct a security audit of existing Chevereto installations to identify any signs of compromise
• If compromise is suspected, isolate the server and perform forensic analysis before restoration

Patch Information

Administrators should upgrade Chevereto to the latest version available. Consult the GitHub Chevereto Release Notes for version history and security updates. The Chevereto Official Website provides official download links and upgrade instructions.

For environments where immediate patching is not possible, implement the workarounds listed below to reduce exposure.

Workarounds

• Delete or rename the /install directory after completing Chevereto setup to prevent access to the installation wizard
• Configure web server rules (Apache .htaccess or Nginx configuration) to deny all access to installation endpoints
• Implement network-level access controls to restrict access to the Chevereto administrative paths to trusted IP addresses only
• Use a web application firewall to filter requests containing PHP code injection patterns in POST parameters

# Nginx configuration to block installation directory access
location ~ ^/install {
    deny all;
    return 403;
}

# Apache .htaccess rule for installation directory
<Directory "/var/www/chevereto/install">
    Require all denied
</Directory>