Schlix CMS RCE (CVE-2021-47964) Exposes Servers to Authenticated Attackers

Schlix CMS 2.2.6-6 contains a critical remote code execution (RCE) vulnerability, tracked as CVE-2021-47964, according to the National Vulnerability Database. This flaw allows authenticated attackers to execute arbitrary PHP code. The attack vector leverages the block manager, where an attacker can upload a malicious extension package.

The exploit chain involves crafting a ZIP file with PHP code embedded within the packageinfo.inc file. Once this malicious extension is installed, merely accessing the ‘About’ tab of the new extension triggers code execution. The National Vulnerability Database rates this with a CVSS score of 8.8 (High), highlighting the severe impact of successful exploitation.

This vulnerability represents a significant risk for organizations running affected Schlix CMS versions. While it requires prior authentication, the ability to execute arbitrary code provides a full system compromise. Defenders need to understand that an attacker only needs valid credentials — which could be stolen, phished, or brute-forced — to achieve server-side RCE. The attacker’s calculus here is straightforward: gain initial access, then elevate to full control.