CVE-2023-45880

GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname and extension. This allows creation of PHP files outside of the uploads...

CVE-2023-45880

GibbonEdu Gibbon (through v25.0.0) is affected by a Directory Traversal via the report template builder. The root cause is the templateFileDestination parameter, which can be set to an arbitrary path and extension, enabling an attacker to write PHP files outside the uploads directory directly int...