pimcore/pimcore · Security
Path traversal in pimcore
- GHSA ID
- GHSA-gjq4-69wj-p6pr
- CVE ID
- CVE-2022-0665
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Description
The application doesn't perform a check/filter against the value of "importFile" parameter at endpoint "/admin/translation/import". After the API is executed, PHP unlink function will proceed to delete the file.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')