Media Convergence System
Monthly
Path traversal in Sobey Media Convergence System 2.0/2.1 allows remote attackers with low privileges to upload files to arbitrary locations on the server by manipulating the File parameter in the /sobey-mchEditor/watermark/upload endpoint. This can be leveraged to write malicious files, such as web shells, to achieve remote code execution under the context of the web server. Exploit code is publicly available, but neither active exploitation nor inclusion in CISA KEV has been confirmed; EPSS indicates a low probability (0.11%) of widespread exploitation.
Path traversal in Sobey Media Convergence System 2.0/2.1 allows remote attackers with low privileges to upload files to arbitrary locations on the server by manipulating the File parameter in the /sobey-mchEditor/watermark/upload endpoint. This can be leveraged to write malicious files, such as web shells, to achieve remote code execution under the context of the web server. Exploit code is publicly available, but neither active exploitation nor inclusion in CISA KEV has been confirmed; EPSS indicates a low probability (0.11%) of widespread exploitation.