Local File Inclusion

2021-02-1902:17:39

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

pimcore

local file inclusion

customreportcontroller

downloadcsvaction

vulnerability

exportfile

authenticated user

get request

EPSS

0.001

Percentile

31.4%

JSON

pimcore is vulnerable to a Local FIle Inclusion. The vulnerability exists due to lack of sanitization of exportFile variable in the downloadCsvAction function of the CustomReportController class, allowing an authenticated user to reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename].