CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a through <= 6.1.15.
Explanation of Vulnerability in Simple Terms
Simple File List versions 6.1.15 and earlier contain a path traversal vulnerability that allows authenticated users to read files outside the intended directory. An attacker with low-level access can navigate the file system using directory traversal sequences to access sensitive files. This affects confidentiality but not integrity or availability.
What an attacker can do
Read arbitrary files on the server outside the intended directory.
Potential impact on your site
Sensitive files (config, database credentials, private data) may be exposed to authenticated users.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
