CVE-2020-18190: Path Traversal
Bludit v3.8.1 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /admin/ajax/upload-profile-picture.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-18190?
CVE-2020-18190 is a vulnerability in Bludit v3.8.1 that allows remote attackers to delete arbitrary files via a directory traversal attack on the /admin/ajax/upload-profile-picture endpoint.
How severe is CVE-2020-18190?
CVE-2020-18190 has a severity score of 9.1, which is considered critical.
How can I fix CVE-2020-18190?
To fix CVE-2020-18190, upgrade to a version of Bludit that is not affected by this vulnerability.
Is there a reference to learn more about CVE-2020-18190?
Yes, you can refer to the GitHub issue [here](https://github.com/bludit/bludit/issues/978) for more information about CVE-2020-18190.
What is CWE-22?
CWE-22 refers to improper limitation of a pathname to a restricted directory, which is a common weakness associated with directory traversal vulnerabilities.