medium4.9Public exploit code
CVE-2022-23409
Duplicate Advisory: Path Traversal in the Logs plugin for Craft CMS
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Ethercreative Logs 3.0.3 - Path Traversal2025-04-16 · webapps · multiple
Impact
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fp63-499m-hq6m. This link is maintained to preserve external references. ## Original Description The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | ether/logs | < 3.0.4 | 3.0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ethercreative | Logs | before 3.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://packetstormsecurity.com/files/165706/Ethercreative-Logs-3.0.3-Path-Traversal.html
- https://plugins.craftcms.com/logs
- https://sec-consult.com/vulnerability-lab/
- https://github.com/advisories/GHSA-9chx-2vqw-8vq5
- https://nvd.nist.gov/vuln/detail/CVE-2022-23409
- https://github.com/ethercreative/logs/commit/eb225cc78b1123a10ce2784790f232d71c2066c4
- https://sec-consult.com/vulnerability-lab