Motranslator
Monthly
Path traversal in phpMyAdmin's MoTranslator library through version 6.0.1 lets an attacker who can influence the 'locale' argument reaching Loader::getTranslator in src/Loader.php cause translation files to be resolved from outside the intended directory, exposing local files (low confidentiality impact, per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The CVSS vector requires low-privileged authenticated access (PR:L), and real-world reachability depends on the consuming application wiring remote request data into the 'locale' parameter, since MoTranslator is a library rather than a standalone network service. No CISA KEV entry exists, but a public PoC reference has been disclosed (not verified as working exploit code), the vendor was contacted and did not respond, and no fixed version is listed in the available data.
Path traversal in phpMyAdmin's MoTranslator library through version 6.0.1 lets an attacker who can influence the 'locale' argument reaching Loader::getTranslator in src/Loader.php cause translation files to be resolved from outside the intended directory, exposing local files (low confidentiality impact, per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The CVSS vector requires low-privileged authenticated access (PR:L), and real-world reachability depends on the consuming application wiring remote request data into the 'locale' parameter, since MoTranslator is a library rather than a standalone network service. No CISA KEV entry exists, but a public PoC reference has been disclosed (not verified as working exploit code), the vendor was contacted and did not respond, and no fixed version is listed in the available data.