CVE-2018-15536

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in archives, allowing for the extraction of crafted archives to overwrite arbitrary files via an extract action, aka Directory Traversal.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2018/Aug/34Exploit, Mailing List, Third Party Advisory
https://www.exploit-db.com/exploits/45271/Exploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Aug/34Exploit, Mailing List, Third Party Advisory
https://www.exploit-db.com/exploits/45271/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Aug 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-155378.8Unrestricted file upload (with remote code execution) in OCS Inventory NG ocsreports allows a privileged user to gain access to the server v CVE-2018-155386.1Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities.CVE-2018-155398.8Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc.CVE-2018-15545.4IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in CVE-2018-155409.8Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to un CVE-2018-155426.4An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The Passcode feature allows authentication bypass via CVE-2018-155436.8An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The FingerprintManager class for Biometric validation CVE-2018-155466.1Accusoft PrizmDoc version 13.3 and earlier contains a Stored Cross-Site Scripting issue through a crafted PDF file.CVE-2018-15555.4IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaSc CVE-2018-155527.5The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a r CVE-2018-155538.8fileshare.cmd on Telus Actiontec T2200H T2200H-31.128L.03 devices allows OS Command Injection via shell metacharacters in the smbdUserid or CVE-2018-155559.8On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker can login with root level access with the user "root" and password "admin" by us