CVE-2018-15495

/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2018-08-18

Last modified

2024-08-05

Weaknesses

CWE-22

Affected products

• Responsive Filemanager (Tecrail)

References

• http://seclists.org/fulldisclosure/2018/Aug/9
• https://github.com/trippo/ResponsiveFilemanager/blob/master/changelog.txt