CVE-2020-13894

HIGH

dext5 < 3.5.1402961 - Arbitrary File Download via savefilepath Parameter

Title source: llm

handler/upload_handler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field.

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

CVSS v3 7.5

EPSS 0.0110

EPSS Percentile 61.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-276

Status published

Products (1)

dext5/dext5 < 3.5.1402961

Published Jun 07, 2020

Tracked Since Feb 18, 2026