PT-2026-44871 · Undefined · Undefined

Publicado 2026-05-29 · Atualizado 2026-05-29 · CVE-2018-25393

NVD

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Navigate CMS 2.8.5 contains a path traversal vulnerability that allows authenticated users to download arbitrary files by injecting directory traversal sequences in the id parameter. Attackers can send GET requests to navigate download.php with path traversal payloads ../../../cfg/globals.php to access sensitive configuration files and system files outside the intended directory.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-25393

Produtos afetados

Undefined

Referências · 5

• https://vulncheck.com/advisories/navigate-cms-path-traversal-via-navigate-download-php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-25393 · Nota de Segurança
• https://navigatecms.com · Nota
• http://master.dl.sourceforge.net/project/navigatecms/releases/navigate-2.8.5r1355.zip · Nota
• https://exploit-db.com/exploits/45615 · Nota