CVE-2020-37219

Description

Joomla com_fabrik 3.9.11 contains a directory traversal vulnerability that allows unauthenticated attackers to list arbitrary files by manipulating the folder parameter. Attackers can send GET requests to the onAjax_files method with path traversal sequences to enumerate files in system directories outside the intended web root.

CVSS Vector

References

• https://fabrikar.com/
• https://fabrikar.com/downloads
• https://www.exploit-db.com/exploits/48263
• https://www.vulncheck.com/advisories/joomla-com-fabrik-directory-traversal-via-image-php