Arbitrary file deletion

2017-05-1005:29:00

PRIOn knowledge base

www.prio-n.com

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.9%

JSON

acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to requests submitted through CSRF.

CPENameOperatorVersion
flatcore-cmseq1.4.7

CPE	Name	Operator	Version
	flatcore-cms	eq	1.4.7

References

github.com/flatCore/flatCore-CMS/issues/30