CVE-2013-1641

Name of the Vulnerable Software and Affected Versions QuiXplorer versions prior to 2.5.5

Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the zip download functionality. This is achieved by using a .. (dot dot) in the selitems[] parameter in a download selected action to "index.php".

Recommendations For versions prior to 2.5.5, update to version 2.5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the download selected action in index.php to minimize the risk of exploitation. Avoid using the selitems[] parameter in the affected API endpoint until the issue is resolved.