CVE-2018-25439 — MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter.…
Published: 2026-10-22 · CVSS: 8.7 · CVSS 4.0
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7