CVE-2016-9835

Critical

Published: 05/12/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Directory traversal vulnerability in 'jcss.php' in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file.

Risk Assessment

An attacker can exploit this vulnerability to inject a malicious PHP object, potentially leading to control over the application or server.

Recommendation

It is recommended to update Zikula to version 1.3.11 or 1.4.4 to mitigate this vulnerability and to monitor the system for potential attack attempts.

Original NVD description (English source)

Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file.