CVE-2015-8794

2022-10-0316:16:00

mitre

www.cve.org

path traversal

roundcube

authenticated users

arbitrary files

contact photo handling

6.2 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.2%

JSON

Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling.