CVE-2018-6397

HIGH

Picture Calendar 3.1.4 - Path Traversal via List.php Folder Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-6397. PoCs published by Ihsan Sencan.

AI-analyzed exploit summary This is a writeup describing a directory traversal vulnerability in Joomla! Component Picture Calendar for Joomla 3.1.4. It provides a URL-based proof of concept for exploiting the vulnerability but does not include functional exploit code.

Description

Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter.

Exploits (1)

exploitdb WRITEUP
by Ihsan Sencan · textwebappsphp
https://www.exploit-db.com/exploits/43931

This is a writeup describing a directory traversal vulnerability in Joomla! Component Picture Calendar for Joomla 3.1.4. It provides a URL-based proof of concept for exploiting the vulnerability but does not include functional exploit code.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Theoretical
Target: Joomla! Component Picture Calendar for Joomla 3.1.4
No auth needed
Prerequisites: Access to the vulnerable Joomla component
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43931/

Scores

CVSS v3 7.5
EPSS 0.1217
EPSS Percentile 95.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-22
Status published
Products (1)
joomlacalendars/picture_calendar 3.1.4
Published Jan 30, 2018
Tracked Since Feb 18, 2026