CVE-2023-3240: OTCMS usersNews_deal.php path traversal

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-06-14 · updated 2026-06-17
Weakness: CWE-24

Description

A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511.

Affected products

OTCMS: through 6.62

References

https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md
https://vuldb.com/?ctiid.231511
https://vuldb.com/?id.231511
https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md
https://vuldb.com/?ctiid.231511
https://vuldb.com/?id.231511

Get alerted when CVE-2023-3240 or the next vulnerability affects your stack