Path Traversal: '\..\filename' in pimcore/pimcore

CVE-2023-2984

What is CVE-2023-2984?

A path traversal vulnerability allows attackers to manipulate file paths and gain unauthorized access to files outside the intended directory. In Pimcore versions prior to 10.5.22, this vulnerability exists due to improper handling of file input that permits traversal sequences such as '..\filename'. Attackers could exploit this flaw to access sensitive files on the server, posing significant security risks. It is crucial for users to update to the latest version to mitigate potential threats associated with this vulnerability.

References