CVE-2026-16219
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A path traversal vulnerability has been found in Croogo CMS up to version 4.0.7 in the Admin File Manager component. The FileManager::isEditable function in FileManager/src/Utility/FileManager.php allows path manipulation. The attack can be initiated remotely and an exploit has been published.
Risk Assessment
The organization is at risk of unauthorized file access outside the intended directory, potentially leading to sensitive data leakage or system compromise.
Recommendation
Immediately update Croogo CMS to the latest available version or apply temporary mitigations such as path validation in the FileManager::isEditable function.
Other vulnerabilities in Croogo CMS
Original NVD description (English source)
A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS