high7.5
CVE-2018-18257
An issue was discovered in BageCMS 3.1.3.
Impact
An issue was discovered in BageCMS 3.1.3. An attacker can delete any files and folders on the web server via an index.php?r=admini/template/batch&command=deleteFile&fileName= or index.php?r=admini/template/batch&command=deleteFolder&folderName=../ directory traversal URI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bagesoft | Bagecms | Version 3.1.3 |