CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Nota-Info Bookly allows Path Traversal, Manipulating Web Input to File System Calls.This issue affects Bookly: from n/a through 21.7.1.
Explanation of Vulnerability in Simple Terms
Bookly versions up to 21.7.1 contain a path traversal vulnerability that allows authenticated users to cause a denial of service by disrupting site availability. An attacker with low-level access can send specially crafted requests to bypass file path restrictions and trigger resource exhaustion. The vulnerability affects the entire site, not just the plugin.
What an attacker can do
Make the site unavailable or unresponsive by exploiting file path handling.
Potential impact on your site
Your site may become slow or unavailable if an authenticated user exploits this flaw.
Conditions required to exploit
Attacker must have a low-level user account (e.g., customer or staff login) on the site.
Key dates
External resources
Related vulnerabilities
