CVE-2017-5539

Critical

Published: 23/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ../ to bypass the filter rule, allowing them to delete or read any files on the server.

Risk Assessment

This vulnerability poses a serious security risk as an attacker can gain access to sensitive data or delete files on the server.

Recommendation

It is recommended to update b2evolution to the latest version to patch this vulnerability and implement additional security measures such as monitoring file access.

Original NVD description (English source)

The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\/ to bypass the filter rule. Then, this attacker can exploit this vulnerability to delete or read any files on the server. It can also be used to determine whether a file exists.