CVE-2019-9889 In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call using a crafted type value, leading to Directory Traversal with...
LowCVSS 2.7
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call using a crafted type value, leading to Directory Traversal with File Inclusion. An attacker can leverage this vulnerability to execute code under the context of the web server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vanillaforums vanilla | < 2.6.4 | 2.6.4 |
References
- github.com third-party-advisory
- github.com third-party-advisory
- hackerone.com exploit third-party-advisory