CVE-2018-6022

Name of the Vulnerable Software and Affected Versions NoneCms versions prior to 1.3.0

Description The issue allows remote authenticated users to delete arbitrary files by providing a .. in the param.path parameter, leveraging back-office access. This is a directory traversal vulnerability in the application/admin/controller/Main.php file.

Recommendations For versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the param.path parameter in the affected controller to minimize the risk of exploitation.