CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Valiano Unite Gallery Lite allows PHP Local File Inclusion.This issue affects Unite Gallery Lite: from n/a through 1.7.59.
Explanation of Vulnerability in Simple Terms
Unite Gallery Lite versions up to 1.7.59 contain a path traversal vulnerability that allows high-privilege users to read files outside the intended directory. An attacker with administrative access can craft requests to access sensitive files on the server. The vulnerability requires admin-level credentials and does not affect file modification or system availability.
What an attacker can do
Read arbitrary files on the server outside the gallery directory.
Potential impact on your site
Admins with malicious intent or compromised admin accounts can access sensitive files like configuration or database backups.
Conditions required to exploit
Attacker must have administrative privileges on the site.
Key dates
External resources
Related vulnerabilities
