PT-2026-23695 · Unknown · Surreal Todo

CVE-2018-25184 · Publicado 2026-03-06 · Atualizado 2026-03-06

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Surreal ToDo version 0.6.1.2

Description The application contains a local file inclusion issue that allows unauthenticated attackers to read arbitrary files. Attackers can manipulate the content parameter in the 'index.php' file to supply directory traversal sequences. This allows access to sensitive system files, such as configuration and initialization files. The vulnerable API endpoint is '/index.php'. The vulnerable parameter is content.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the 'index.php' file.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-25184

Produtos afetados

Surreal Todo

Referências · 4

• https://exploit-db.com/exploits/45826 · Nota
• https://t.me/CVEtracker/46600 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-25184 · Nota de Segurança
• https://vulncheck.com/advisories/surreal-todo-local-file-inclusion-via-indexphp · Nota