CVE-2019-7234

9.1 criticalEPSS 2.2%

Critical (9.1) in idreamsoft icms. EPSS 2.2% chance of exploitation in the next 30 days.

An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file can then be downloaded via an admincp.php?app=apps&do=pack request.

Severity

CVSS 3.0

9.1 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2019-01-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

idreamsoft:icms

References

https://github.com/idreamsoft/iCMS/issues/51
https://github.com/idreamsoft/iCMS/issues/51

Check your stack JSON