CVE-2026-16219

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-16219

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16219.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-16219

Published

2026-07-19T06:00:11.583Z

Modified

2026-07-22T05:30:10.645242714Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Croogo CMS Admin File Manager FileManager.php isEditable path traversal

Details

A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16219.json"
}

References

Affected packages

Git / github.com/croogo/croogo

Affected ranges

Type

GIT

Repo

https://github.com/croogo/croogo

Events

Introduced

3600e03145fba748a04c78447ce185d39bfed77c

Last affected

1462a01f42b0c666f6784220b576506eff1cce5f

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.0.0"
        },
        {
            "introduced": "4.0.1"
        },
        {
            "last_affected": "4.0.1"
        },
        {
            "introduced": "4.0.2"
        },
        {
            "last_affected": "4.0.2"
        },
        {
            "introduced": "4.0.3"
        },
        {
            "last_affected": "4.0.3"
        },
        {
            "introduced": "4.0.4"
        },
        {
            "last_affected": "4.0.4"
        },
        {
            "introduced": "4.0.5"
        },
        {
            "last_affected": "4.0.5"
        },
        {
            "introduced": "4.0.6"
        },
        {
            "last_affected": "4.0.6"
        },
        {
            "introduced": "4.0.7"
        },
        {
            "last_affected": "4.0.7"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16219.json"