CVE-2017-5541 Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to rename arbitrary files via a .. (dot dot) in the existing-folder....
MediumCVSS 5.3
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to rename arbitrary files via a .. (dot dot) in the existing-folder and new-folder parameters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| getsymphony symphony | <= 2.6.9 | No fix listed |
References
- 95689 third-party-advisory vdb-entry
- github.com vdb-entry
- github.com release-notes