Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the PathUtils.RemoveParentPath function of the /api/admin/plugins/install/actions/download endpoint. An attacker can access unauthorized files or directories by manipulating the path argument. PoC POST...

CVE-2026-4222 SSCMS download PathUtils.RemoveParentPath path traversal

A vulnerability was determined in SSCMS up to 7.4.0. This vulnerability affects the function PathUtils.RemoveParentPath of the file /api/admin/plugins/install/actions/download. This manipulation of the argument path causes path traversal. Remote exploitation of the attack is possible. The exploit...

CVE-2026-4222

SCMS SSCMS: Affected software is SSCMS up to version 7.4.0. The vulnerability is in PathUtils.RemoveParentPath used by /api/admin/plugins/install/actions/download, enabling path traversal. It allows remote exploitation and the exploit has been publicly disclosed. Vendor did not respond to disclos...