CWE-22

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changing isFullChunkFilePresent to have an early false return when input doesn’t match expectations.Concrete CMS Security team ranked this 5.8 with CVSS v3.1 vector AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H. Credit to Siebene for reporting.

Shopwind <=v3.4.2 was discovered to contain a Arbitrary File Download vulnerability via the neirong parameter at backendcontrollersDbController.php.

Shopwind <=v3.4.2 was discovered to contain a Arbitrary File Delete vulnerability via the neirong parameter at backendcontrollersDbController.php.

ftcms <=2.1 was discovered to be vulnerable to directory traversal attacks via the parameter tp.

ftcms <=2.1 was discovered to be vulnerable to Arbitrary File Read via tp.php

static_compressed_inmemory_website_callback.c in Glewlwyd through 2.6.2 allows directory traversal.