CVE-2018-16961 Path traversal in n/a
Remote attackers can read arbitrary PDF files via path traversal in Open XDMoD, exposing sensitive documents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-16961?
CVE-2018-16961 is a high-severity path traversal vulnerability in n/a, published on 2 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/dl_publication.php allows Path traversal via the file parameter, allowing remote attackers to read PDF files in arbitrary directories.
Weakness: CWE-22
Which versions are affected by CVE-2018-16961?
It affects 1 product.
Products include Buffalo Open Xdmod.
How do I fix CVE-2018-16961?
No fix has been published for CVE-2018-16961 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-16961 being exploited?
There is no known exploitation of CVE-2018-16961 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-16988 Auth bypass in n/a
- CVE-2026-45777 Open XDMoD Vulnerable to Unauthenticated Remote Code Execution (RCE) via OS Command Injection
- CVE-2026-45779 Open XDMoD Vulnerable to Unauthenticated SQL Injection Leading to Full Database Compromise
- CVE-2026-45778 Open XDMoD Vulnerable to Reflected Cross-Site Scripting (XSS) in Password Reset
- CVE-2018-16960 Cross-site scripting in n/a
Sources
Also known as GHSA-qvvc-7369-335j.