CVE-2018-10469

CRITICAL 9.8CVE-2018-10469 · Published 27/04/2018 · updated 17/06/2026

In short

CVE-2018-10469 is a CRITICAL (CVSS 9.8) vulnerability affecting symphony (b3log).
Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 81.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
symphony b3log	`= 2.6.0`	No fix yet

b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.