CVE-2023-1427 Photo Gallery by 10Web < 1.8.15 - Admin+ Path Traversal
High-privilege users can exploit a path traversal flaw to place images anywhere in the filesystem, bypassing upload restrictions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-1427?
CVE-2023-1427 is a medium-severity path traversal vulnerability in Unknown Photo Gallery by 10Web, published on 17 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector.
Which versions are affected by CVE-2023-1427?
It affects 1 product.
Products include 10web Photo Gallery.
How do I fix CVE-2023-1427?
No fix has been published for CVE-2023-1427 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-1427 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1427 exists.
Other vulnerabilities in Unknown Photo Gallery by 10Web
Sources
Also known as GHSA-rwcv-wwxv-h77x.