CVE-2018-15536

/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in archives, allowing for the extraction of crafted archives to overwrite arbitrary files via an extract action, aka Directory Traversal.

CVSS v3.0

5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

5.8 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P

EPSS

6.41% chance of exploitation in the next 30 days, 93th percentile

Published

2018-08-24

Updated

2024-08-05

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/45271

References

• CVE Record
• NVD entry

Related

• CVE-2018-15535
• CVE-2018-15556
• CVE-2018-15534
• CVE-2018-15557
• CVE-2018-15533
• CVE-2018-15560