CVE-2015-4425

Severity: medium (CVSS 4.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-08-18 · updated 2026-06-17
Weakness: CWE-22

Description

Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.

Affected products

pimcore/pimcore: all versions

References

http://seclists.org/fulldisclosure/2015/Jul/57
https://github.com/pimcore/pimcore/commit/4f2a95f877d406a054f9f2253475fe58c76aa03d
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-4425/
http://seclists.org/fulldisclosure/2015/Jul/57
https://github.com/pimcore/pimcore/commit/4f2a95f877d406a054f9f2253475fe58c76aa03d
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-4425/

Get alerted when CVE-2015-4425 or the next vulnerability affects your stack