CVE-2018-25439

HighCVSS 7.5/10Last modified Oct 22, 2026

Description

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Oct 22, 2026
Last modified
Oct 22, 2026
NVD status
Deferred

Related CVEs from 2018

CVE-2018-25605.0Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected iCVE-2018-25615.3Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affeCVE-2018-25627.1Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition). Supported versions that are affected are 5.5CVE-2018-25634.2Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: LDAP Library). Supported versions that are affectCVE-2018-25648.2Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). The supported version thCVE-2018-25654.9Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.7.20 CVE-2018-25667.7Vulnerability in the Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: Remote Console AppliCVE-2018-25676.1Vulnerability in the Oracle Communications Order and Service Management component of Oracle Communications Applications (subcomponent: PortaCVE-2018-25687.3Vulnerability in the Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: Remote Console AppliCVE-2018-25697.8Vulnerability in the Java ME SDK component of Oracle Java Micro Edition (subcomponent: Installer). The supported version that is affected isCVE-2018-25706.3Vulnerability in the Oracle Communications Unified Inventory Management component of Oracle Communications Applications (subcomponent: PortaCVE-2018-25715.4Vulnerability in the Oracle Communications Unified Inventory Management component of Oracle Communications Applications (subcomponent: Porta
CVE-2018-25439: High severity, CVSS 7.5 | Vulnix