CVE-2018-12939

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A directory traversal flaw in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows an authenticated attacker to write to (or potentially delete) arbitrary files via a .. (dot dot) in the "op/op.UploadChunks.php" "qquuid" parameter. NOTE: this can be leveraged to execute arbitrary code by using CVE-2018-12940.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOGPatch, Release Notes, Third Party Advisory
https://www.contextis.com/resources/advisories/cve-2018-12939Patch, Third Party Advisory
https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOGPatch, Release Notes, Third Party Advisory
https://www.contextis.com/resources/advisories/cve-2018-12939Patch, Third Party Advisory

Timeline

Published: Jul 31, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-12947.5If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that CVE-2018-129408.8Unrestricted file upload vulnerability in "op/op.UploadChunks.php" in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attack CVE-2018-129418.8This vulnerability allows remote attackers to execute arbitrary code in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 by adding a system CVE-2018-129428.8SQL injection vulnerability in the "Users management" functionality in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows authenticate CVE-2018-129436.1Cross-Site Scripting (XSS) vulnerability in every page that includes the "action" URL parameter in SeedDMS (formerly LetoDMS and MyDMS) befo CVE-2018-129446.1Persistent Cross-Site Scripting (XSS) vulnerability in the "Categories" feature in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows CVE-2018-12959.8In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, whic CVE-2018-129597.5The approveAndCall function of a smart contract implementation for Aditus (ADI), an Ethereum ERC20 token, allows attackers to steal assets (CVE-2018-12967.5In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during li CVE-2018-12979.8When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to ge CVE-2018-129716.5EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users.CVE-2018-129729.8An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2ran