PT-2026-121379

CVE-2018-25439

·

Published

2026-10-22

·

Updated

2026-10-22

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str replace filter to read files like config db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Related identifiers
CVE-2018-25439
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com