contao/core · Security
Contao Core directory traversal vulnerability
- GHSA ID
- GHSA-4r6g-xhx7-fm36
- CVE ID
- CVE-2015-0269
- Severity
- medium
- Published
- Updated
- CVSS
- 4.3 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 4.3 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated backend users to view files outside their file mounts or the document root via unspecified vectors.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-0269 ↗
- https://contao.org/en/news/contao-3_2_19.html ↗
- https://contao.org/en/news/contao-3_4_4.html ↗
- https://contao.org/en/news/directory-traversal-vulnerability-cve-2015-0269.html ↗
- https://github.com/contao/core/commit/0229e839b4849e402256b972eb62f89f2c29674d ↗
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2015-0269.yaml ↗
- https://github.com/advisories/GHSA-4r6g-xhx7-fm36 ↗