CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV MailChimp ssv-mailchimp allows PHP Local File Inclusion.This issue affects SSV MailChimp: from n/a through <= 3.1.5.
Explanation of Vulnerability in Simple Terms
SSV MailChimp versions 3.1.5 and earlier contain a path traversal vulnerability that allows an attacker to read or write arbitrary files on the server. The vulnerability requires user interaction—the victim must visit a malicious link or page. An attacker can access sensitive files outside the intended directory, potentially exposing configuration files, database credentials, or other private data.
What an attacker can do
Read or write arbitrary files on the server by traversing the directory structure.
Potential impact on your site
Attackers can steal configuration files, database credentials, or other sensitive data stored on your server.
Conditions required to exploit
No authentication required, but the victim must click a malicious link or visit an attacker-controlled page.
Key dates
External resources
Related vulnerabilities
