medium6.5
CVE-2025-28367
mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action.
Impact
mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mojoportal | Mojoportal | before 2.9.1.0 |