CVE-2018-13299 Path traversal in Calendar

What is CVE-2018-13299?

CVE-2018-13299 is a medium-severity path traversal vulnerability in Synology Calendar, published on 1 Apr 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename parameter.

Weakness: CWE-22, CWE-23

Which versions are affected by CVE-2018-13299?

It affects 1 product.

Products include Synology Calendar.

How do I fix CVE-2018-13299?

No fix has been published for CVE-2018-13299 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2018-13299 being exploited?

There is no known exploitation of CVE-2018-13299 in the wild and no public exploit code.

Other vulnerabilities in Synology Calendar

• CVE-2019-11829 Command injection in Calendar High 7.3
• CVE-2022-22686 Cross-site request forgery in Synology Calendar Medium 6.5
• CVE-2022-22682 Cross-site scripting in Synology Calendar Medium 6.5
• CVE-2019-11825 Cross-site scripting in Calendar Medium 6.5
• CVE-2018-8915 Cross-site scripting in Calendar Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rx7v-r27h-28rm.