PT-2026-61053 · Unknown · Croogo Cms

Fa1C4 · CVE-2026-16219 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Croogo CMS versions prior to 4.0.8

Description A path traversal flaw exists in the Admin File Manager component. The issue resides in the isEditable() function within the FileManager/src/Utility/FileManager.php file. This flaw allows a remote attacker to manipulate file paths to access unauthorized directories.

Recommendations Update Croogo CMS to version 4.0.8 or later. As a temporary mitigation, restrict access to the Admin File Manager component.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-16219

Affected Products

Croogo Cms

References · 8

• 🔥 https://github.com/fa1c4/security-advisories/tree/main/Croogo · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-16219 · Security Note
• https://github.com/croogo/croogo/issues/1008 · Note
• https://vuldb.com/submit/857986 · Note
• https://vuldb.com/cve/CVE-2026-16219 · Note
• https://vuldb.com/vuln/380042 · Note
• https://vuldb.com/vuln/380042/cti · Note
• https://twitter.com/VulmonFeeds/status/2078748581301785060 · Twitter Post