What’s Vulnerable › Vulnerabilities

CVE-2021-47751: CuteEditor for PHP 6.6 - Directory Traversal

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-13 · updated 2026-06-17
• Weakness: CWE-22

Description

CuteEditor for PHP (now referred to as Rich Text Editor) 6.6 contains a directory traversal vulnerability in the browse template feature that allows attackers to write files to arbitrary web root directories. Attackers can exploit the ServerMapPath() function by renaming uploaded HTML files using directory traversal sequences to write files outside the intended template directory.

Affected products

• Phphtmledit Rich Text Editor: through 6.6

References

• http://phphtmledit.com/
• https://www.exploit-db.com/exploits/50994
• https://www.vulncheck.com/advisories/cuteeditor-for-php-directory-traversal
• https://www.exploit-db.com/exploits/50994

Get alerted when CVE-2021-47751 or the next vulnerability affects your stack