CVE-2014-9155

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-12-01 · updated 2026-06-17
Weakness: CWE-22

Description

Directory traversal vulnerability in the Avatar Uploader module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta6 for Drupal allows remote authenticated users to read arbitrary files via a .. (dot dot) in the path of a cropped picture in the uploader panel.

Affected products

avatar_uploader: 6.x-1.0, 6.x-1.1, 7.x-1.0-beta1, 7.x-1.0-beta2, 7.x-1.0-beta3, 7.x-1.0-beta4 (+1)

References

https://www.drupal.org/node/2330759
https://www.drupal.org/node/2330763
https://www.drupal.org/node/2332169
https://www.drupal.org/node/2330759
https://www.drupal.org/node/2330763
https://www.drupal.org/node/2332169

Get alerted when CVE-2014-9155 or the next vulnerability affects your stack