CVE-2018-15535 /filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutraliz...
HighCVSS 7.5
EPSS 44.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize get_file sequences such as ".." that can resolve to a location that is outside of that directory, aka Directory Traversal.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Tecrail Responsive FileManager | < 9.13.4 | 9.13.4 |
References
- 20180821 RESPONSIVE filemanager exploit mailing-list third-party-advisory
- 45271 exploit third-party-advisory vdb-entry