CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
Mac Photo Gallery 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the albid parameter. Attackers can send requests to macdownload.php with directory traversal sequences to access sensitive files like wp-load.php outside the intended plugin directory.
Explanation of Vulnerability in Simple Terms
Mac Photo Gallery versions 3.0 and later contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server through specially crafted requests. No user interaction is required. The vulnerability affects file confidentiality but not integrity or availability.
What an attacker can do
Read arbitrary files from the server, including configuration files and sensitive data.
Potential impact on your site
Attackers can access sensitive files like database credentials, configuration, and private user data without logging in.
Conditions required to exploit
Network access to the application; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
