CVE-2015-8358

CRITICAL 9.0CVE-2015-8358 · Published 16/12/2015 · updated 17/06/2026

In short

CVE-2015-8358 is a CRITICAL (CVSS 9.0) vulnerability affecting mpbuilder (bitrix).
Chance of exploitation in the next 30 days (EPSS): 6.6%, higher than 93.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
mpbuilder bitrix	`≤ 1.0.11`	No fix yet

Description

Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the element name of the "work" array parameter to admin/bitrix.mpbuilder_step2.php.

References

packetstormsecurity.com/files/134766/bitrix.mpbuilder-Bitrix-1.0.10-Local-File-Inclusion.html · Exploit
securityfocus.com/archive/1/537067/100/0/threaded
marketplace.1c-bitrix.ru/solutions/bitrix.mpbuilder
exploit-db.com/exploits/38975
htbridge.com/advisory/HTB23281 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free