VulnerabilityPublished 25 Apr 2018Updated 30 May 2025

CVE-2018-10209: Vaultize Enterprise File Sharing

Source CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 10:12 UTC

Severity

High

Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA

EPSS: 0.6% chance of exploitation in 30 days – higher than 48% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Apr 2018
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
n/a n/a	Affected =17.05.31	Fixed in–

AI-suggested

To mitigate this vulnerability, European organizations using Vaultize Enterprise File Sharing should implement the following specific measures: 1) Immediately review and sanitize all file and folder names uploaded to the system to remove or encode potentially malicious characters or scripts. 2) Apply strict input validation and output encoding on the download pop-up interface to neutralize any embedded scripts in file or folder names. 4) Employ Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts within the application context. 5) Conduct regular security awareness training for users to recognize suspicious behavior and report anomalies. 6) Monitor web application logs for unusual activity related to file or folder name inputs and download pop-up access. 7) Consider implementing Web Application Firewalls (WAF) with rules to detect and block XSS payloads targeting the file sharing platform.

Description

An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS on the file or folder download pop-up via a crafted file or folder name.

Impact

For European organizations, this vulnerability poses a significant risk especially for enterprises relying on Vaultize Enterprise File Sharing for secure document exchange and collaboration. Exploitation could lead to unauthorized access to sensitive corporate data, leakage of confidential information, and compromise of user credentials. Given the nature of stored XSS, attackers could execute arbitrary scripts in the browsers of employees, potentially enabling lateral movement within corporate networks or facilitating phishing attacks that appear highly credible. This risk is heightened in sectors with stringent data protection requirements such as finance, healthcare, and government institutions prevalent across Europe. Additionally, exploitation could lead to non-compliance with GDPR mandates on data security and breach notification, resulting in legal and financial penalties. The absence of known exploits in the wild suggests limited active targeting, but the vulnerability remains a latent threat if unaddressed.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Jul 2025, 14:56 UTC

Technical details

References

Community reviews

Related threats