Threats tagged 'ghsa-8fjh-p7j5-79fg'

A path traversal vulnerability exists in liweiyi ChestnutCMS up to version 1.5.8 in the resourceDownload function of the /dev-api/common/download endpoint. This flaw allows remote attackers with high privileges to manipulate the path argument, potentially accessing unauthorized files. The vulnerability has a low CVSS score of 2.7 and public exploit code is available.