CVE-2018-12939

—

CVSS 3.0

6.5 medium

EPSS

2%p79

Published

Jul 31, 2018 (Jul 31, 2018)

Modified

Jun 17, 2026

Description

A directory traversal flaw in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows an authenticated attacker to write to (or potentially delete) arbitrary files via a .. (dot dot) in the "op/op.UploadChunks.php" "qquuid" parameter. NOTE: this can be leveraged to execute arbitrary code by using CVE-2018-12940.

Vendors: seeddms
Products: seeddms
Weakness: CWE-22
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (2.0%)

In the news0 stories

No ingested article mentions this CVE yet.