Summary
MetInfo CMS versions 6.0.0 through before 6.1.1 contain a path traversal vulnerability in the /include/thumb.php endpoint. An unauthenticated attacker may be able to read arbitrary files by supplying crafted values to the dir parameter, particularly where backslash-based filtering can be bypassed on Windows systems.
MetInfo CMS versions 6.0.0 through before 6.1.1 contain a path traversal vulnerability in the /include/thumb.php endpoint. An unauthenticated attacker may be able to read arbitrary files by supplying crafted values to the dir parameter, particularly where backslash-based filtering can be bypassed on Windows systems.
Affected context
The vulnerability occurs in MetInfo CMS deployments using the affected thumbnail-handling endpoint. Risk is present when the endpoint accepts attacker-controlled path data, applies incomplete filtering, and uses that data to access files without reliably constraining the resolved path to an intended directory.
The vulnerability occurs in MetInfo CMS deployments using the affected thumbnail-handling endpoint. Risk is present when the endpoint accepts attacker-controlled path data, applies incomplete filtering, and uses that data to access files without reliably constraining the resolved path to an intended directory.
Exploit preconditions
- Attack surface: The
/include/thumb.phpHTTP endpoint - Required access: No authentication may be required
- Trigger point: Processing of attacker-controlled input supplied through the
dirparameter - Why exploitation is possible: Insufficient path canonicalization and filter bypass conditions can allow the requested path to escape its intended directory
- Attack surface: The
/include/thumb.phpHTTP endpoint - Required access: No authentication may be required
- Trigger point: Processing of attacker-controlled input supplied through the
dirparameter - Why exploitation is possible: Insufficient path canonicalization and filter bypass conditions can allow the requested path to escape its intended directory
Why this happens
The underlying flaw is improper limitation of a user-controlled filesystem path. Filtering based on simple string replacement does not provide reliable path containment because alternate separators, canonicalization behavior, and platform-specific path handling may produce a different effective path.
This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where application input influences file access without a robust, canonical containment check.
The underlying flaw is improper limitation of a user-controlled filesystem path. Filtering based on simple string replacement does not provide reliable path containment because alternate separators, canonicalization behavior, and platform-specific path handling may produce a different effective path.
This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where application input influences file access without a robust, canonical containment check.
Potential impact
- An attacker may read sensitive application or operating-system files
- Database credentials and other configuration secrets could be exposed
- Disclosure of source code may support follow-on attacks
- Exposed credentials could enable unauthorized access to connected services
- The CMS environment could face increased risk of broader compromise
- An attacker may read sensitive application or operating-system files
- Database credentials and other configuration secrets could be exposed
- Disclosure of source code may support follow-on attacks
- Exposed credentials could enable unauthorized access to connected services
- The CMS environment could face increased risk of broader compromise
General mitigation guidance
Mitigation generally focuses on removing direct trust in user-supplied filesystem paths.
Common defensive patterns include:
- Resolve paths canonically and verify that the result remains within an explicitly permitted base directory
- Prefer server-generated file identifiers or allowlisted resource names over raw path input
- Reject traversal indicators and platform-specific separator variants as an additional defense, not as the sole control
- Apply strict input validation before any filesystem operation
- Restrict the web process to the minimum filesystem permissions required
- Keep sensitive configuration files outside web-accessible or user-controlled directories
- Use secure-by-default file-handling APIs that enforce directory boundaries
Mitigation generally focuses on removing direct trust in user-supplied filesystem paths.
Common defensive patterns include:
- Resolve paths canonically and verify that the result remains within an explicitly permitted base directory
- Prefer server-generated file identifiers or allowlisted resource names over raw path input
- Reject traversal indicators and platform-specific separator variants as an additional defense, not as the sole control
- Apply strict input validation before any filesystem operation
- Restrict the web process to the minimum filesystem permissions required
- Keep sensitive configuration files outside web-accessible or user-controlled directories
- Use secure-by-default file-handling APIs that enforce directory boundaries
How teams detect issues like this
Organizations can look for path traversal risks through:
- Static analysis rules identifying filesystem calls that receive request parameters
- Code review checks for string-replacement filtering used as a path-security control
- Tests covering canonicalization, alternate separators, encoded input, and platform-specific path behavior
- Web application logs showing unusual values submitted to file or directory parameters
- Runtime policies restricting the application process from reading sensitive filesystem locations
- Automated security review tools that flag user-controlled paths lacking containment validation
Organizations can look for path traversal risks through:
- Static analysis rules identifying filesystem calls that receive request parameters
- Code review checks for string-replacement filtering used as a path-security control
- Tests covering canonicalization, alternate separators, encoded input, and platform-specific path behavior
- Web application logs showing unusual values submitted to file or directory parameters
- Runtime policies restricting the application process from reading sensitive filesystem locations
- Automated security review tools that flag user-controlled paths lacking containment validation
