CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal. This issue affects Gravity Forms: from n/a through 2.10.0.1.
Explanation of Vulnerability in Simple Terms
Gravity Forms versions up to 2.10.0.1 contain a path traversal vulnerability that allows an attacker to read or write arbitrary files on the server. The vulnerability requires user interaction—typically a victim must click a malicious link or visit a crafted page. Successful exploitation grants access to sensitive files and can lead to site compromise.
What an attacker can do
Read or write arbitrary files on the server, potentially exposing sensitive data or injecting malicious code.
Potential impact on your site
Attackers can access configuration files, database credentials, or inject code to take over the site.
Conditions required to exploit
User interaction required (victim must click a link or visit a page); no authentication needed.
Key dates
External resources
Related vulnerabilities
