CVE-2018-11248

2018-05-1818:00:00

mitre

www.cve.org

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

53.1%

JSON

util/FileDownloadUtils.java in FileDownloader 1.7.3 does not check an attachment’s name. If an attacker places “…/” in the file name, the file can be stored in an unintended directory because of Directory Traversal.

References

github.com/lingochamp/FileDownloader/issues/1028