GHSA-rw73-xmpv-j5x2Medium

CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files

Published
May 1, 2022
Last Modified
January 30, 2023

🔗 CVE IDs covered (1)

CVE-2006-5031 →

📋 Description

Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with %00 and a .js filename.

🎯 Affected products1

  • composer/cakephp/cakephp:>= 1.0.1.2708, < 1.1.8.3544

🔗 References (7)