GitHub Advisoryadvisory · Packagist

GHSA-wcj4-ff9m-5r7g ImpressCMS Path Traversal to Arbitrary File Delete

MEDIUM Published 2022-05-17 Modified 2023-08-16 Official page ↗
Aliases
CVE-2014-1836
Ecosystem
Packagist
Packages
impresscms/impresscms
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2023-08-16

Affected packages

• Packagist impresscms/impresscms: < 1.3.6 → fixed in 1.3.6

Description

Absolute path traversal vulnerability in `htdocs/libraries/image-editor/image-edit.php` in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the `image_path` parameter in a cancel action.

Related

Alias · CVE (1)

  • CVE-2014-1836 Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References