cve.bz

CVE-2016-7135

4.9 mediumEPSS 2.6%

Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions.

Severity

CVSS 3.0

4.9 medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS
2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE
CWE-22
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-m7f9-65wr-pwchPyPIplone>=5.0 <5.0.75.0.7
GHSA-m7f9-65wr-pwchPyPIplone>=4.2 <4.3.124.3.12
PYSEC-2017-58PyPIplone>=5.0 <5.0.7
>=4.2 <4.3.12		5.0.7, 4.3.12

References

Check your stackJSON