CVE-2022-24977

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHPSESSIONUPLOADPROGRESS when the PHP installation supports...

CVE-2022-24977: Improper Limitation of a Pathname to a Restricted Directory

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHPSESSIONUPLOADPROGRESS when the PHP installation supports...

PT-2022-6872

Name of the Vulnerable Software and Affected Versions ImpressCMS versions prior to 1.4.2 Description The issue is related to insufficient restrictions on the directory path name in the processimage.php component of the ImpressCMS system. This can be exploited by a remote attacker to execute...