CVE-2016-4313

High

Published: 24/04/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitrary files via a .. (dot dot) in an archive file.

Risk Assessment

An attacker could exploit this vulnerability to execute malicious code on the server, potentially leading to serious security breaches.

Recommendation

It is recommended to update eXtplorer to the latest version to mitigate this vulnerability and implement additional security measures such as scanning archive files.

Other vulnerabilities in eXtplorer 2.1.9

CVE-2017-12756High
In extplorer versions 2.1.9 and prior, there is a command injection vulnerability in the transfer function from another server, allowing an attacker to inject commands via the userfile[0] parameter.

Original NVD description (English source)

Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitrary files via a .. (dot dot) in an archive file.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS