CVE-2017-5541
MEDIUMSymphony < 2.6.9 - Path Traversal via User Error Template Parameters
Title source: llmDescription
Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to rename arbitrary files via a .. (dot dot) in the existing-folder and new-folder parameters.
References (3)
Core 3
Core References
Release Notes x_refsource_confirm
https://github.com/symphonycms/symphony-2/releases/tag/2.6.10
VDB Entry x_refsource_confirm
https://github.com/symphonycms/symphony-2/issues/2639
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/95689
Scores
CVSS v3
5.3
EPSS
0.0248
EPSS Percentile
82.6%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Details
CWE
CWE-22
Status
published
Products (1)
getsymphony/symphony
< 2.6.9
Published
Jan 20, 2017
Tracked Since
Feb 18, 2026