CVE-2018-20127 Path traversal in n/a

High 7.5 Published 13 Dec 2018 Updated 5 Aug 2024

Remote attackers can delete arbitrary files in zzzphp CMS by bypassing extension filters using mixed-case characters and extra dots.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-20127?

CVE-2018-20127 is a high-severity path traversal vulnerability in n/a, published on 13 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in zzzphp cms 1.5.8. del_file in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because (for example) "php" is blocked but path=F:/1.phP. succeeds.

Weakness: CWE-20

Which versions are affected by CVE-2018-20127?

It affects 1 product.

Products include Zzzcms Zzzphp.

How do I fix CVE-2018-20127?

No fix has been published for CVE-2018-20127 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2018-20127 being exploited?

There is no known exploitation of CVE-2018-20127 in the wild and no public exploit code.

Sources

Also known as GHSA-9gcf-rjxj-c7gp.