CVE-2020-8260 - AskarLabs CVE Database

CVE-2020-8260

Vendor N/A

Product Pulse Connect Secure / Pulse Policy Secure

Weakness CWE-434 · Unrestricted file upload

KEV Status Known Exploited

Published October 28, 2020

Last update October 21, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.

CISA mandated remediation

02CISA Required Action

Apply updates per vendor instructions.

Key dates

03Disclosure timeline

October 28, 2020 CVE published

October 21, 2025 Record updated

External resources

04References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-8260 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html CISA KEV Reference https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-… CISA KEV Reference https://nvd.nist.gov/vuln/detail/CVE-2020-8260

Related vulnerabilities

05Related CVE

CVE-2021-24222 WP-Curricul Vitea Free <= 6.3 - Unauthenticated Arbitrary File Upload to RCE CVE-2026-9009 Crawlomatic Multipage Scraper Post Generator <= 2.7.2 - Authenticated (Author+) Remote Code Execution via 'callback_raw' Shortcode Attribute CVE-2023-4122 Student Information System v1.0 - Insecure File Upload CVE-2025-15503 Sangfor Operation and Maintenance Management System common.jsp unrestricted upload CVE-2022-41681 File Upload vulnerability in Forma LMS