EUVD-2026-49756
GHSA-5wcv-j62r-8fp5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (cert) · only source for this CVE.
CVSS VectorVendor: cert
Lifecycle Timeline
1DescriptionCVE.org
A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read contents of files located in the sibling directory of the webroot via a crafted HTTP request containing ../ sequences in the URI.
The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
AnalysisAI
Quick.CMS allows authenticated administrators to read arbitrary files outside the webroot via a path traversal in HTTP URIs. An attacker with admin credentials can craft requests with ../ sequences to access sensitive sibling directories. The vendor assessed exploitation likelihood as very low and will not issue a patch.
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today