{"id":"CVE-2018-25439","revision":"142720dc0d9f4d9fb9a3f370bb2ae13c","records":[{"revision":"142720dc0d9f4d9fb9a3f370bb2ae13c","observedAt":"2026-10-29T13:12:12.589+00:00","statement":{"source":"cve-program","id":"CVE-2018-25439","aliases":[],"title":"MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter","description":"MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","state":0,"publishedAt":"2026-10-22T10:57:26.044+00:00","modifiedAt":"2026-10-29T11:09:34.251+00:00","affected":[{"ecosystem":"Vendor product","name":"MetInfo","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"vendor\": \"MetInfo\",\n                    \"product\": \"MetInfo\",\n                    \"versions\": [\n                        {\n                            \"version\": \"6.0.0\",\n                            \"lessThan\": \"6.1.1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://web.archive.org/web/20190916061234/https://paper.seebug.org/676/","https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/metinfo-lfi.yaml","https://www.metinfo.cn/","https://www.vulncheck.com/advisories/metinfo-cms-6.1.1-unauthenticated-path-traversal-via-thumb-php-dir-parameter"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2018-25439","license":"CVE Program Terms of Use","key":"cve-program:CVE-2018-25439","identifiers":["CVE-2018-25439"]},"retained":false,"historicalAffected":[]}],"coverage":[]}