Textpattern
CVE-2023-36220
HIGH
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function.
AnalysisAI
Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function. Affected products include: Textpattern.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.
More in Textpattern
View allAn issue was discovered in Textpattern CMS 4.6.2 and earlier. Rated critical severity (CVSS 9.8), this vulnerability is
There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of
An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute a
Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem. Rated high severity (CVSS 8.8), this vulnerability is remotel
TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbi
TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload a
textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial
An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute
Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background witho
A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which a
A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remo
A second-order XSS vulnerability exists in Textpattern CMS version 4.9.0 where user-supplied input (such as category par
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today