Threats affecting pkg:github/croogo/croogo

A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2024-42718 is a path traversal vulnerability in Croogo CMS version 4.0.7 that allows remote attackers with limited privileges to read arbitrary files by manipulating the 'edit-file' parameter. The vulnerability does not require user interaction but does require some level of authentication. It impacts confidentiality by exposing sensitive files but does not affect integrity or availability. The CVSS score is 6.5, indicating a medium severity level. There are no known exploits in the wild yet, and no patches have been linked at this time. European organizations using Croogo CMS 4.0.