CVE-2018-25439 MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter

Q: What is CVE-2018-25439?

CVE-2018-25439 is a high-severity vulnerability in MetInfo, published on 22 Oct 2026.

Q: Is CVE-2018-25439 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-25439 exists.

Q: How do I fix CVE-2018-25439?

No fix has been published for CVE-2018-25439 yet. Limit exposure of the affected software until one is available.

High 8.7 Published 22 Oct 2026 Updated 29 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2018-25439?

CVE-2018-25439 is a high-severity vulnerability in MetInfo, published on 22 Oct 2026.

Official description

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

Weakness: CWE-22

Which versions are affected by CVE-2018-25439?

How do I fix CVE-2018-25439?

No fix has been published for CVE-2018-25439 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-25439 being exploited?