CVE-2018-17567

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "_config.yml" file.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/jekyll/jekyll/pull/7224Patch, Third Party Advisory
https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8/Patch, Vendor Advisory
https://lists.apache.org/thread.html/71da391f584b2fb301d2df0e491b279d87287e2fb4b11309f04ad984%40%3Ccommits.accumulo.apache.org%3E
https://github.com/jekyll/jekyll/pull/7224Patch, Third Party Advisory
https://jekyllrb.com/news/2018/09/19/security-fixes-for-3-6-3-7-3-8/Patch, Vendor Advisory
https://lists.apache.org/thread.html/71da391f584b2fb301d2df0e491b279d87287e2fb4b11309f04ad984%40%3Ccommits.accumulo.apache.org%3E

Timeline

Published: Sep 28, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-175689.8utils/ut_rpc.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.CVE-2018-175699.8network/nw_buf.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.CVE-2018-17575.3IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive information due to missing a CVE-2018-175709.8utils/ut_ws_svr.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.CVE-2018-175716.1Vanilla before 2.6.1 allows XSS via the email field of a profile.CVE-2018-175724.8InfluxDB 0.9.5 has Reflected XSS in the Write Data module.CVE-2018-175739.8The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor CVE-2018-175745.4An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.CVE-2018-175759.8SWA SWA.JACAD 3.1.37 Build 024 has SQL Injection via the /academico/aluno/esqueci-minha-senha/ studentId parameter.CVE-2018-17585.4IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users t CVE-2018-175807.1A heap-based buffer over-read exists in the function fast_edit_packet() in the file send_packets.c of Tcpreplay v4.3.0 beta1. This can lead CVE-2018-175816.5CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Den