CVE-2014-1836

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-07-01 · updated 2026-06-17
Weakness: CWE-22

Description

Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the image_path parameter in a cancel action.

Affected products

ImpressCMS: through 1.3.5

References

http://community.impresscms.org/modules/smartsection/item.php?itemid=675
http://osvdb.org/show/osvdb/102770
http://seclists.org/fulldisclosure/2014/Feb/14
http://www.securityfocus.com/bid/65279
https://github.com/pedrib/PoC/blob/master/generic/impresscms-1.3.5.txt
http://community.impresscms.org/modules/smartsection/item.php?itemid=675
http://osvdb.org/show/osvdb/102770
http://seclists.org/fulldisclosure/2014/Feb/14
http://www.securityfocus.com/bid/65279
https://github.com/pedrib/PoC/blob/master/generic/impresscms-1.3.5.txt

Get alerted when CVE-2014-1836 or the next vulnerability affects your stack