CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in docxpresso Docxpresso docxpresso allows Absolute Path Traversal.This issue affects Docxpresso: from n/a through <= 2.6.
Explanation of Vulnerability in Simple Terms
Docxpresso versions 2.6 and earlier contain a path traversal vulnerability that allows an attacker to read arbitrary files from the server. The vulnerability requires specific conditions to exploit but does not require authentication. An attacker can access sensitive files outside the intended directory structure, potentially exposing configuration files, source code, or other confidential data.
What an attacker can do
Read arbitrary files from the server filesystem without authentication.
Potential impact on your site
Sensitive files on the server may be exposed, including configuration files with database credentials or API keys.
Conditions required to exploit
Network access to the vulnerable Docxpresso instance; specific attack conditions must be met (high complexity).
Key dates
External resources
