CVE-2013-1469 Path traversal in n/a

What is CVE-2013-1469?

CVE-2013-1469 is a medium-severity path traversal vulnerability in Piwigo Piwigo, published on 13 Mar 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter.

Weakness: CWE-22

Which versions are affected by CVE-2013-1469?

It affects 1 product.

Products include Piwigo Piwigo.

How do I fix CVE-2013-1469?

No fix has been published for CVE-2013-1469 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2013-1469 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-1469 exists.

Public exploit code: 2 Exploit-DB entries.

Other vulnerabilities in Piwigo Piwigo

• CVE-2014-4648 Unspecified vulnerability in Piwigo before 2.6.3 has unknown impact and attack vectors, related to a "security failure." Critical 10.0
• CVE-2023-33361 SQL injection in n/a Critical 9.8
• CVE-2023-33362 SQL injection in n/a Critical 9.8
• CVE-2020-19213 SQL injection in n/a Critical 9.8
• CVE-2021-32615 SQL injection in n/a Critical 9.8

All Piwigo Piwigo vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p4fq-jh4w-p6hr.