CVE-2018-11196

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-01 · updated 2026-06-17
Weakness: CWE-434

Description

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 can be used as medium to transmit viruses by placing infected files into a Leap2A archive and uploading that to Mahara. In contrast to other ZIP files that are uploaded, ClamAV (when activated) does not check Leap2A archives for viruses, allowing malicious files to be available for download. While files cannot be executed on Mahara itself, Mahara can be used to transfer such files to user computers.

Affected products

mahara: from 17.04.0 before 17.04.8; from 17.10.0 before 17.10.5; 18.04.0 — fixed in 17.04.8, 17.10.5

How to fix

Upgrade to a fixed version: mahara 17.04.8, 17.10.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-11196 or the next vulnerability affects your stack