CVE-2018-25312 HIGH

CVE-2018-25312: LifeSize ClearSea 3.1.4 Directory Traversal Remote Code Execution

Vendor Lifesize
Product ClearSea
Weakness CWE-22 · Path traversal
Published April 29, 2026
Last update April 30, 2026

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

LifeSize ClearSea 3.1.4 contains directory traversal vulnerabilities that allow authenticated attackers to download and upload arbitrary files by manipulating path parameters in the smartgui interface. Attackers can exploit the upload endpoint with directory traversal sequences to write files to arbitrary locations on the system, enabling remote code execution.

Key dates

02Disclosure timeline

April 29, 2026 CVE published
April 30, 2026 Record updated