high7.5
CVE-2018-19181
statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action=remove key paramet…
Impact
statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action=remove key parameter, as demonstrated by using directory traversal to delete the install.lock file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Yunucms | Yunucms | Version 1.1.5 |