CVE-2021-47751

5.3 mediumEPSS 0.9%

CuteEditor for PHP (now referred to as Rich Text Editor) 6.6 contains a directory traversal vulnerability in the browse template feature that allows attackers to write files to arbitrary web root directories. Attackers can exploit the ServerMapPath() function by renaming uploaded HTML files using directory traversal sequences to write files outside the intended template directory.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2026-01-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phphtmledit:rich_text_editor

References

http://phphtmledit.com/
https://www.exploit-db.com/exploits/50994
https://www.vulncheck.com/advisories/cuteeditor-for-php-directory-traversal
https://www.exploit-db.com/exploits/50994

Check your stack JSON