PT-2026-45108 · Openises · Open Ises

Published 2026-05-30 · Updated 2026-05-30 · CVE-2018-25408

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Open ISES Project version 3.30A

Description A path traversal issue exists in the 'ajax/download.php' endpoint. Unauthenticated attackers can download arbitrary files, including system and configuration files, by manipulating the filename parameter using directory traversal sequences such as ../. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder.

Recommendations As a temporary workaround, restrict access to the 'ajax/download.php' endpoint or avoid using the filename parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-25408

Affected Products

Open Ises

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-25408 · Security Note
• https://sourceforge.net/projects/openises/files/latest/download · Note
• https://exploit-db.com/exploits/45655 · Note
• https://vulncheck.com/advisories/the-open-ises-project-3-30a-path-traversal-arbitrary-file-download · Note
• http://openises.sourceforge.net · Note
• https://t.me/cveNotify/165318 · Telegram Post