CVE-2018-11248

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-18 · updated 2026-06-17
Weakness: CWE-22

Description

util/FileDownloadUtils.java in FileDownloader 1.7.3 does not check an attachment's name. If an attacker places "../" in the file name, the file can be stored in an unintended directory because of Directory Traversal.

Affected products

Liulishuo Filedownloader: 1.7.3

References

https://github.com/lingochamp/FileDownloader/issues/1028
https://github.com/lingochamp/FileDownloader/issues/1028

Get alerted when CVE-2018-11248 or the next vulnerability affects your stack