CyberRota Analysis
AI-GeneratedA Path Traversal vulnerability in Quick.CMS allows authenticated attackers with admin privileges to exploit improperly handled dot-dot-slash (../) sequences in HTTP request URIs, enabling them to access files in sibling directories of the webroot. Although the vendor has assessed the likelihood of exploitation as very low and deemed a fix unnecessary, organizations using Quick.CMS should prioritize monitoring and mitigating potential risks associated with this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read contents of files located in the sibling directory of the webroot via a crafted HTTP request containing ../ sequences in the URI. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.