CVE-2018-13864

HIGH

Lightbend Play Framework < 2.6.15 - Path Traversal

Title source: rule

Description

A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.

Exploits (1)

nomisec STUB

by tafamace · poc

https://github.com/tafamace/CVE-2018-13864

View Code ZIP pw:eip

References (1)

[Vendor Advisory] https://www.playframework.com/security/vulnerability/CVE-2018-13864-PathTraversal

Scores

CVSS v3 7.5

EPSS 0.0126

EPSS Percentile 79.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-22

Status published

Products (2)

com.typesafe.play/play_2.12 2.6.12 - 2.6.16Maven

lightbend/play_framework 2.6.12 - 2.6.15

Published Jul 17, 2018

Tracked Since Feb 18, 2026