CVE-2018-15535

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-15535

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-15535.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-15535

Published

2018-08-24T19:29:01.860Z

Modified

2026-07-08T17:15:41.830706Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

/filemanager/ajaxcalls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize getfile sequences such as ".." that can resolve to a location that is outside of that directory, aka Directory Traversal.

References

Affected packages

Git / github.com/trippo/responsivefilemanager

Affected ranges

Type

GIT

Repo

https://github.com/trippo/responsivefilemanager

Events

Introduced

Fixed

a50cac88ebcf8b469a189b1097758592c3807150

Database specific

{
    "cpe": "cpe:2.3:a:tecrail:responsive_filemanager:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.13.4"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

9.*

9.9

9.9.1

9.9.2

9.9.4

v.*

v.9.10.1

v9.*

v9.10.0

v9.10.1

v9.10.2

v9.11.0

v9.11.3

v9.12.0

v9.12.1

v9.12.2

v9.13.0

v9.13.1

v9.13.3

v9.9.3

v9.9.4

v9.9.5

v9.9.6

v9.9.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-15535.json"