CVEvulnerability

CVE-2008-6658

4.0 MEDIUM Published 2009-04-07 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-04-07
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
Weaknesses
CWE-22

Description

Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. (dot dot) in the package parameter during an install2 action, as demonstrated by a predictable package filename in attachments/ that was uploaded through a post2 action to index.php.

Affected configurations

• simple machines simple machines forum 1.0.5 • simple machines simple machines forum 1.0.6 • simple machines simple machines forum 1.0.7 • simple machines simple machines forum 1.0.11 • simple machines simple machines forum 1.0.12 • simple machines simple machines forum 1.1.1 • simple machines simple machines forum 1.1.2 • simple machines simple machines forum 1.1.3 • simple machines simple machines forum 1.1.4 • simple machines simple machines forum 1.1.5 • simple machines simple machines forum 1.1.6 • simple machines simple machines forum 1.1 rc1 • simple machines simple machines forum 1.1 rc2 • simple machines simple machines forum 1.1 rc3

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References