Path traversal

2021-03-1518:15:00

PRIOn knowledge base

www.prio-n.com

8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.0%

JSON

The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)

CPENameOperatorVersion
grav_cmseq1.7.0 beta8
grav_cmseq1.7.0 beta9
grav_cmseq1.7.0 beta10
grav_cmseq1.7.0 rc1
grav_cmseq1.7.0 rc2
grav_cmseq1.7.0 rc3
grav_cmseq1.7.0 rc4
grav_cmseq1.7.0 rc5
grav_cmseq1.7.0 rc6
grav_cmseq1.7.0 rc7

Name	Operator	Version
grav_cms	eq	1.7.0 beta8
grav_cms	eq	1.7.0 beta9
grav_cms	eq	1.7.0 beta10
grav_cms	eq	1.7.0 rc1
grav_cms	eq	1.7.0 rc2
grav_cms	eq	1.7.0 rc3
grav_cms	eq	1.7.0 rc4
grav_cms	eq	1.7.0 rc5
grav_cms	eq	1.7.0 rc6
grav_cms	eq	1.7.0 rc7