A vulnerability was found in GreenCMS up to 2.3. This affects an unknown part of the file /DataController.class.php of the component File Handler. Performing a manipulation of the argument sqlFiles/zipFiles results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 2.0 · njtechNVD modified 2026-10-13 09:10
Affected (CPE criteria) 1
cpe:2.3:a:njtech:greencms:*:*:*:*:*:*:*:*
References 7
- https://github.com/ueh1013/VULN/issues/4 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/ueh1013/VULN/issues/5 Exploit, Issue Tracking, Third Party Advisory
- https://vuldb.com/?ctiid.338572 Permissions Required, VDB Entry
- https://vuldb.com/?id.338572 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.721387 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.724836 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.725143 Third Party Advisory, VDB Entry