Directory traversal

A directory traversal flaw in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows an authenticated attacker to write to or potentially delete arbitrary files via a .. dot dot in the "op/op.UploadChunks.php" "qquuid" parameter. NOTE: this can be leveraged to execute arbitrary code by using...

CVE-2018-12939

A directory traversal flaw in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows an authenticated attacker to write to or potentially delete arbitrary files via a .. dot dot in the "op/op.UploadChunks.php" "qquuid" parameter. NOTE: this can be leveraged to execute arbitrary code by using...

CVE-2018-12939

SeedDMS (formerly LetoDMS/MyDMS) is vulnerable to a directory traversal flaw in op/op.UploadChunks.php that allows an authenticated attacker to write/delete arbitrary files. Affected versions are SeedDMS prior to 5.1.8; 5.1.8 fixes the issue. The vulnerability stems from unsafely handling the qqu...