CVE-2018-16836

CRITICALNuclei

rubedo_project rubedo Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2018-16836 has a selected CVSS score of 9.8 (critical); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 7, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

rubedo

Browse rubedo_project / rubedo
VulnCheckVersion data not supplied

Proofs of concept

1

Catalogued exploits

ExploitDBRubedo CMS 3.4.0 - Directory TraversalExploitDB exploitby Marouene BoubakriNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALRubedo CMS <=3.4.0 - Directory TraversalCVSS 9.8

Rubedo CMS through 3.4.0 contains a directory traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI.

Impact

An attacker can exploit this vulnerability to read arbitrary files on the server.

Remediation

Upgrade to a patched version of Rubedo CMS (>=3.4.1) or apply the provided security patch.

WeaknessesCWE-22
Authors0x_Akoko
Template tagscve2018cverubedolfiedbrubedo_projectvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:rubedo_project:rubedo:*:*:*:*:*:*:*:*
https://www.exploit-db.com/exploits/45385 https://nvd.nist.gov/vuln/detail/CVE-2018-16836 https://github.com/maroueneboubakri/CVE/tree/master/rubedo-cms https://www.exploit-db.com/exploits/45385/ https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3