Codiad Vulnerable to Shell Command Injection

CRITICAL 9.8CVE-2017-11366 · GHSA-jccv-3h4x-35mv · Published 21/08/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
codiad/codiad Packagist	`< 2.8.3`	`2.8.3`
codiad codiad	`≤ 2.8.3`	No fix yet

Description

components/filemanager/class.filemanager.php in Codiad before 2.8.3 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by search_file_type.

NVD description

components/filemanager/class.filemanager.php in Codiad before 2.8.4 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by search_file_type.

References

nvd.nist.gov/vuln/detail/CVE-2017-11366 · ADVISORY
Codiad/Codiad · WEB
Codiad/Codiad#1013 · WEB
Codiad/Codiad#1013 · WEB
Codiad/Codiad commit ca5089e · WEB
Codiad/Codiad · PACKAGE
jianshu.com/p/41ac7ac2a7af · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free