Path Traversal in Pimcore

CVE-2015-4425

Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.038 (89.0th percentile) — read the EPSS interpretation.

Affected products

Pimcore
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cve@mitre.org (mailing-list, x_refsource_FULLDISC)
cve@mitre.org (Exploit, x_refsource_MISC)
cve@mitre.org (x_refsource_CONFIRM)