GHSA-xxjj-jhgc-r68fMedium

Alkacon OpenCMS Absolute Path Traversal via pathname in filePath.0 parameter

Published
May 1, 2022
Last Modified
June 20, 2025

🔗 CVE IDs covered (1)

CVE-2008-1301 →

📋 Description

Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated administrators to read arbitrary files via a full pathname in the filePath.0 parameter.

🎯 Affected products1

  • maven/org.opencms:opencms-core:>= 7.0.3, < 7.0.5

🔗 References (5)