Path traversal in pimcore/pimcore

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class bundles/AdminBundle/Controller/Reports/CustomReportController.php. An authenticated user can reach this function with a GET...

Local File Inclusion

pimcore is vulnerable to a Local FIle Inclusion. The vulnerability exists due to lack of sanitization of exportFile variable in the downloadCsvAction function of the CustomReportController class, allowing an authenticated user to reach this function with a GET request at the following endpoint:...