Security Advisory

CVE-2018-9851

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2018-04-08 02:00:00

Last updated 2024-09-17 02:31:58

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read any file via a modified pathname in an Admin-Tpl request, as demonstrated by use of '|' instead of '/' as a directory separator, in conjunction with a ".." sequence.

← Browse all CVEs View on cve.org ↗