Two vulnerabilities impacting Craft CMS were chained together ... This allowed the attacker to install a PHP-based file manager on the server to compromise the system further.