Path traversal in pimcore/pimcore

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class bundles/AdminBundle/Controller/Reports/CustomReportController.php. An authenticated user can reach this function with a GET...

Local File Inclusion

pimcore is vulnerable to a Local FIle Inclusion. The vulnerability exists due to lack of sanitization of exportFile variable in the downloadCsvAction function of the CustomReportController class, allowing an authenticated user to reach this function with a GET request at the following endpoint:...

CVE-2021-23340

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class bundles/AdminBundle/Controller/Reports/CustomReportController.php. An authenticated user can reach this function with a GET...

PT-2021-15444

Name of the Vulnerable Software and Affected Versions pimcore/pimcore versions prior to 6.8.8 Description A Local File Inclusion issue exists in the downloadCsvAction function of the CustomReportController class. This can be reached by an authenticated user through a GET request at the endpoint...

CVE-2021-23340: Improper Limitation of a Pathname to a Restricted Directory

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class bundles/AdminBundle/Controller/Reports/CustomReportController.php. An authenticated user can reach this function with a GET...