CVE-2015-10142 Sitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known Path
Attackers can download arbitrary files from the web root if the filename is known, exposing sensitive data in Sitecore CMS and XP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-10142?
CVE-2015-10142 is a medium-severity path traversal vulnerability in Sitecore Content Management System (CMS), published on 25 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of the file is already known via a specially-crafted URL. Affected files do not include .config, .aspx or .cs files. The issue does not allow for directory browsing.
Weakness: CWE-610
Which versions are affected by CVE-2015-10142?
How do I fix CVE-2015-10142?
No fix has been published for CVE-2015-10142 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2015-10142 being exploited?
There is no known exploitation of CVE-2015-10142 in the wild and no public exploit code.
Sources
Also known as GHSA-4m57-4hqx-rgqv.