Description
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Published: 2026-10-22
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Unauthenticated path traversal allowing arbitrary file reads
Action: Immediate Patch
AI Analysis

Impact

MetInfo CMS exposes an unauthenticated path traversal flaw in the /include/thumb.php dir parameter, letting attackers craft requests with backslash sequences that bypass a naïve str_replace filter and read any file on the server, such as config_db.php on Windows installations. The vulnerability is classified as CWE‑22, a classic directory traversal weakness that can disclose sensitive configuration and credential data.

Affected Systems

The issue affects MetInfo CMS versions prior to 6.1.1, specifically the 6.0.0‑6.1.0 product line released by MetInfo.

Risk and Exploitability

The CVSS score of 8.7 rates the flaw as high severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via simple HTTP requests, so any machine running a vulnerable MetInfo CMS instance is at risk of unauthorized file disclosure. The impact is mainly confidentiality compromise, potentially exposing database credentials and other sensitive data.

Generated by OpenCVE AI on October 22, 2026 at 12:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade MetInfo CMS to version 6.1.1 or later, which removes the faulty filter.
  • If an upgrade cannot be performed immediately, block or restrict access to /include/thumb.php with a web‑application firewall or server configuration to prevent arbitrary dir parameter usage.
  • Ensure that sensitive files such as config_db.php are not world‑readable and apply restrictive file permissions to the web root to limit exposure.

Generated by OpenCVE AI on October 22, 2026 at 12:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Title MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter
First Time appeared Metinfo
Metinfo metinfo
Weaknesses CWE-22
CPEs cpe:2.3:a:metinfo:metinfo:*:*:*:*:*:*:*:*
Vendors & Products Metinfo
Metinfo metinfo
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Metinfo Metinfo
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-22T10:57:26.044Z

Reserved: 2026-10-14T20:25:26.526Z

Link: CVE-2018-25439

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-22T11:17:03.620

Modified: 2026-10-22T11:17:03.620

Link: CVE-2018-25439

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T12:30:05Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')