CVE-2024-42718

MediumCVSS 6.5

Published: 26/12/2025(UTC)Updated: 27/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.65%

51th percentile - higher than 51% of all known CVEs

Summary

A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter.

Risk Assessment

An attacker may read sensitive files from the server, potentially exposing configuration data, credentials, or other sensitive information.

Recommendation

Update Croogo CMS to a patched version and restrict access to file editing functionality to trusted administrators only.

Other vulnerabilities in Croogo CMS

CVE-2026-16219Medium
A path traversal vulnerability has been found in Croogo CMS up to version 4.0.7 in the Admin File Manager component. The FileManager::isEditable function in FileManager/src/Utility/FileManager.php allows path manipulation. The attack can be initiated remotely and an exploit has been published.

Original NVD description (English source)

A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS