CVE-2017-8868

acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to requests submitted through CSRF.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2017-05-10

Last modified

2024-08-05

Weaknesses

CWE-22

Affected products

• Flatcore-cms (Flatcore)

References

• https://github.com/flatCore/flatCore-CMS/issues/30