CVE-2023-27507
CRITICALMicroEngine Mailform 1.1.0-1.1.8 - Path Traversal and Arbitrary File Write via File Upload Function
Title source: llmDescription
MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability. If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and execute it.
References (2)
Core 2
Core References
Third Party Advisory
https://jvn.jp/en/jp/JVN31701509/
Vendor Advisory
https://microengine.jp/information/security_2023_05.html
Scores
CVSS v3
9.8
EPSS
0.0128
EPSS Percentile
66.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-22
Status
published
Products (1)
microengine/mailform
1.1.0 - 1.1.9
Published
May 23, 2023
Tracked Since
Feb 18, 2026