critical9.8Public exploit code
CVE-2018-16836
Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary file…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Rubedo CMS 3.4.0 - Directory Traversal2018-09-12 · webapps · linux
Impact
Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rubedo Project | Rubedo | through 3.4.0 |