EUVD-2026-12359Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was determined in SSCMS up to 7.4.0. This vulnerability affects the function PathUtils.RemoveParentPath of the file /api/admin/plugins/install/actions/download. This manipulation of the argument path causes path traversal. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
A path traversal vulnerability exists in SSCMS versions up to 7.4.0 within the PathUtils.RemoveParentPath function of the plugin download API endpoint (/api/admin/plugins/install/actions/download). An authenticated administrator with high privileges can manipulate the path argument to traverse the file system and access or modify files outside the intended directory, potentially leading to information disclosure or system compromise. The vulnerability has public proof-of-concept code available, though the CVSS score of 3.8 is relatively low due to the requirement for authenticated administrative access, making this a lower-priority but still exploitable issue in environments where admin credentials may be compromised.
Technical ContextAI
The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) and affects the SSCMS content management system. The root cause lies in the PathUtils.RemoveParentPath function failing to properly sanitize or validate user-supplied path input before processing it in the plugin download API endpoint. SSCMS is a .NET-based content management system (CPE identifiable as cpe:2.3:a:sscms:sscms), and the vulnerable code path processes administrative requests for plugin downloads without adequate path canonicalization or whitelist validation, allowing attackers to inject path traversal sequences (such as ../ or ..\) that bypass intended directory restrictions and access arbitrary files on the underlying file system.
RemediationAI
Immediately upgrade SSCMS to version 7.5.0 or later if available from the vendor or community maintainers; however, given the vendor's unresponsive disclosure history, verify that patches are available before assuming an upgrade path exists. As an interim mitigation, restrict network access to the /api/admin/plugins/install/actions/download endpoint by implementing network-level access controls (firewall rules, WAF rules, or reverse proxy configuration) limiting access to trusted internal networks or administrative workstations only. Enforce strong multi-factor authentication for all administrative accounts to reduce the risk of credential compromise. Additionally, implement file system permissions that limit the SSCMS application's write access to only its intended plugin directory, preventing exploitation from cascading into broader system compromise. Monitor access logs for suspicious path traversal patterns (../ or ..\) in the plugin download API for signs of active exploitation.
SQL injection in SSCMS v7.4.0 enables high-privileged attackers to execute arbitrary SQL statements via the stl:sqlConte
An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory travers
SSCMS 4.7.0's layerImage endpoint allows authenticated attackers to manipulate the filePaths parameter in LayerImageCont
SQL injection in SSCMS 7.4.0 via the tableHandWrite parameter in SitesAddController.Submit.cs allows authenticated remot
SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component. R
SSCMS 7.2.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Material Management comp
SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Column Management component. Ra
Reflected cross-site scripting in SSCMS v7.4.0 allows authenticated attackers to inject arbitrary JavaScript through cra
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today