EUVD-2026-14294Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS score of 5.4 suggests medium severity, multiple factors elevate real-world risk: the vulnerability requires only low privileges (authenticated user, PR:L per CVSS vector), has low attack complexity (AC:L), and is remotely exploitable (AV:N). The CVSS vector shows no confidentiality impact (C:N) but does affect integrity (I:L) and availability (A:L), limiting damage scope. Critically, a public proof-of-concept is disclosed (E:P per vector) and available via the referenced Yuque link, meaning active exploitation is probable. The EPSS designation as 'RL:X/RC:R' (reliability: unknown, confidence: reasonable) suggests moderate confidence in exploit reliability. The automation of the attack is feasible given the straightforward nature of path traversal attacks. This is a genuine priority for organizations running SSCMS 4.7.0, as the combination of public POC, low barrier to exploitation, and authenticated attack surface (reducing but not eliminating risk) warrants immediate patching. |
| Exploit ScenarioDerived | An authenticated attacker with a valid SSCMS user account crafts an HTTP POST request to the layerImage endpoint, manipulating the filePaths parameter with a path traversal payload such as '../../../etc/passwd' or '..\..\..\windows\system32\config\sam' to read sensitive configuration or system files outside the intended upload directory. Alternatively, the attacker could attempt directory traversal combined with file write operations (if the endpoint permits) to achieve remote code execution by placing malicious files in executable directories. Since a public proof-of-concept is available, attackers can rapidly adapt and deploy exploits against SSCMS instances that have not been patched. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 22, 2026
SSCMS 4.7.0's layerImage endpoint allows authenticated attackers to manipulate the filePaths parameter in LayerImageController.Submit.cs, enabling path traversal attacks that can modify or delete arbitrary files on the server. Public exploit code exists for this vulnerability, and no patch is currently available.
Earlier versions of this analysis (1)
A path traversal vulnerability exists in SSCMS 4.7.0 within the LayerImageController.Submit.cs component of the layerImage endpoint, allowing authenticated attackers to manipulate the filePaths argument to access arbitrary files on the system. The vulnerability has a CVSS score of 5.4 (medium severity) with impact limited to integrity and availability, though successful exploitation requires valid user credentials. A public proof-of-concept exploit is available, increasing real-world exploitation risk.
RemediationAI
Immediately upgrade SSCMS to the latest patched version released after 4.7.0; consult the official SSCMS repository or security mailing list for the specific patch version number and advisory details. If an immediate upgrade is not feasible, implement input validation on the filePaths parameter by enforcing a whitelist of allowed file names/paths, rejecting any input containing path traversal sequences ('../', absolute paths, or URL-encoded variants), and using file canonicalization functions to ensure the resolved path remains within the intended directory. Additionally, enforce strict access controls ensuring only authorized users can access the layerImage endpoint, consider implementing Web Application Firewall (WAF) rules to detect and block path traversal attempts, and monitor file system access logs for suspicious activity. The public POC reference at https://www.yuque.com/la12138/pa2fpb/vlyutc51eb7vhwaz?singleDoc should be reviewed to understand attack mechanics and validate remediation effectiveness.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal flaw where user-supplied input is not properly validated before being used in file system operations. The affected component is the LayerImageController.Submit.cs file within SSCMS (likely a content management system), specifically in the layerImage endpoint handling. The filePaths parameter is processed without adequate sanitization, allowing attackers to use path traversal sequences (such as '../' or absolute paths) to access files outside the intended directory structure. This occurs in a REST/HTTP endpoint accessible remotely, indicating the web application accepts untrusted file path inputs directly from the client without canonicalization or whitelisting.
Know when Sscms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in SSCMS 4.7.0. The affected element is an unknown function of the file LayerImageController.Submit.cs of the component layerImage Endpoint. Such manipulation of the argument filePaths leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4542, a path traversal vulnerability rated CVSS 5.4. This could allow unauthorized file access. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict file access via WAF, implement allowlists.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in. Rated critical severity (CVSS 9.8)
A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1. Rated medium severity (CV
siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerabili
SQL injection in SSCMS v7.4.0 enables high-privileged attackers to execute arbitrary SQL statements via the stl:sqlConte
An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory travers
SQL injection in SSCMS 7.4.0 via the tableHandWrite parameter in SitesAddController.Submit.cs allows authenticated remot
A path traversal vulnerability exists in SSCMS versions up to 7.4.0 within the PathUtils.RemoveParentPath function of th
SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component. R
SSCMS 7.2.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Material Management comp
SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Column Management component. Ra
Site-scoped authorization bypass in SiteServer SSCMS through 7.4.0 allows an authenticated administrator who holds Chann
Improper access control in SiteServer SSCMS 7.4.0's Agent Installation Workflow allows remote attackers to bypass securi
GitHub PoC
Exploit-DB