CVE-2018-18869

EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e/admin/ecmscom.php path parameter.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-10-31

Last modified

2024-09-17

Weaknesses

CWE-22

Affected products

• Empirecms (Phome)

References

• https://qclover.github.io/2018/10/10/EmpireCMS_V7.5%E7%9A%84%E4%B8%80%E6%AC%A1%E5%AE%A1%E8%AE%A1.html