PT-2026-44866 · Undefined · Undefined

Published 2026-05-29 · Updated 2026-05-29 · CVE-2018-25388

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by bypassing file type validation. Attackers can upload PHP files through multiple endpoints including aksi foto.php, aksi user.php, and aksi kecamatan.php to execute arbitrary code on the server.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-25388

Affected Products

Undefined

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-25388 · Security Note
• http://sitejo.id · Note
• https://exploit-db.com/exploits/45593 · Note
• https://sourceforge.net/projects/hape-pkh/files/latest/download · Note
• https://vulncheck.com/advisories/hape-pkh-arbitrary-file-upload-via-aksi-foto-php · Note