CVE-2020-35598

Name of the Vulnerable Software and Affected Versions ACS Advanced Comment System version 1.0

Description The issue allows Directory Traversal via the advanced component system/index.php API endpoint, specifically through the ACS path variable. This can be exploited by manipulating the ACS path variable with a URI such as ..%2f.

Recommendations For ACS Advanced Comment System version 1.0, as a temporary workaround, consider restricting access to the advanced component system/index.php API endpoint until a patch is available. Avoid using the ACS path variable in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.