CVE-2018-19181

statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action=remove key parameter, as demonstrated by using directory traversal to delete the install.lock file.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2018-11-11

Last modified

2024-09-17

Weaknesses

CWE-22

Affected products

• Yunucms (Yunucms)

References

• https://github.com/doublefast/yunucms/issues/1