CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innate Images LLC VR Calendar vr-calendar-sync allows PHP Local File Inclusion.This issue affects VR Calendar: from n/a through <= 2.4.0.
Explanation of Vulnerability in Simple Terms
VR Calendar versions 2.4.0 and earlier contain a path traversal vulnerability that allows an attacker to read or write arbitrary files on the server. The vulnerability requires user interaction—the victim must visit a malicious link or page. An attacker can access sensitive files outside the intended directory, potentially exposing configuration files, database credentials, or other private data.
What an attacker can do
Read or write arbitrary files on the server by traversing the directory structure.
Potential impact on your site
Attackers can steal sensitive files like config.php or .env, or inject malicious code into the site.
Conditions required to exploit
No authentication required, but the victim must click a malicious link or visit an attacker-controlled page.
Key dates
External resources
Related vulnerabilities
