CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows Path Traversal.This issue affects Upload Files Anywhere: from n/a through <= 2.8.
Explanation of Vulnerability in Simple Terms
Upload Files Anywhere versions 2.8 and earlier contain a path traversal vulnerability that allows an attacker to write files outside the intended upload directory. By crafting a malicious file upload request, an attacker can place files anywhere on the server filesystem, potentially overwriting critical files or injecting malicious code. No authentication or user interaction is required to exploit this flaw.
What an attacker can do
Write files to arbitrary locations on the server filesystem, potentially overwriting critical files or injecting malicious code.
Potential impact on your site
An attacker can overwrite site files, inject malicious code, or disable the site without needing to log in.
Conditions required to exploit
Network access to the upload endpoint; no authentication or user interaction required.
Key dates
External resources
