CVE-2018-20127

HIGH · CVSS 7.5 EPSS 1.39%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2018-12-13 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE

CVE-2018-20127

Severity

HIGH

CVSS

7.5

EPSS

1.39%

Original NVD Description

An issue was discovered in zzzphp cms 1.5.8. del_file in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because (for example) "php" is blocked but path=F:/1.phP. succeeds.