What’s Vulnerable › Vulnerabilities

CVE-2016-20023

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-05 · updated 2026-06-17
• Weakness: CWE-23

Description

In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.

Affected products

• CKSource CKFinder: before 2.5.0.1 — fixed in 2.5.0.1

How to fix

Upgrade to a fixed version: CKSource CKFinder 2.5.0.1. Check the vendor advisory for mitigations.

References

• https://download.cksource.com/CKFinder/CKFinder%20for%20ASP.NET/2.5.0.1/
• https://ckeditor.com/ckfinder/release-notes/

Get alerted when CVE-2016-20023 or the next vulnerability affects your stack