CVE-2023-7041

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this issue is some unknown functionality of the file /file-manager/rename.php. The manipulation of the argument newName leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248690 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-24

Affected software

Vendor	Product	Versions
codelyfe	Stupid Simple CMS	1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4

References

https://github.com/g1an123/POC/blob/main/Unauthorized%20file%20overwrite.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.248690Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.248690Third Party Advisory, VDB Entry
https://github.com/g1an123/POC/blob/main/Unauthorized%20file%20overwrite.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.248690Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.248690Third Party Advisory, VDB Entry

Timeline

Published: Dec 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-70425.5A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in drivers/net/wireless/ath/ath10k/wmi-tlv.c CVE-2023-70435.5Unquoted service path in ESET products allows to drop a prepared program to a specific location and run on boot with the NT AUTHORITY\Ne CVE-2023-70445.4The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St CVE-2023-70456.1A CSRF vulnerability exists within GitLab CE/EE from versions 13.11 before 16.10.6, from 16.11 before 16.11.3, from 17.0 before 17.0.1. By l CVE-2023-70467.5The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPress is vulnerable to Se CVE-2023-70474.4Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop Manager CVE-2023-70484.3The My Sticky Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.6. This is due CVE-2023-70494.3The Custom Field For WP Job Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includ CVE-2023-70505.4A vulnerability has been found in PHPGurukul Online Notes Sharing System 1.0 and classified as problematic. Affected by this vulnerability i CVE-2023-70514.3A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0 and classified as problematic. Affected by this issue is some unknow CVE-2023-70524.3A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been classified as problematic. This affects an unknown part CVE-2023-70538.8A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been declared as problematic. This vulnerability affects unk