What is the CVSS score of CVE-2016-20023?

CVE-2016-20023 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Ckfinder are affected by CVE-2016-20023?

Organizations using CKSource CKFinder should be aware of moderate risk from CVE-2016-20023 rated CVSS 5.0. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2016-20023?

Within 30 days: Identify affected systems running CKSource CKFinder and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Ckfinder CVE-2016-20023

EUVD-2016-10801 MEDIUM

Relative Path Traversal (CWE-23)

2025-12-05 cve@mitre.org

Information Disclosure Ckfinder Cksource

5.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.5.0.1

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2016-10801

Analysis Generated

Mar 15, 2026 - 17:08 vuln.today

CVE Published

Dec 05, 2025 - 06:16 nvd

MEDIUM 5.0

DescriptionCVE.org

In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.