CVE-2018-18869

CRITICAL 9.8CVE-2018-18869 · Published 31/10/2018 · updated 17/06/2026

In short

CVE-2018-18869 is a CRITICAL (CVSS 9.8) vulnerability affecting empirecms (phome).
Chance of exploitation in the next 30 days (EPSS): 3.7%, higher than 89.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
empirecms phome	`= 7.5`	No fix yet

Description

EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e/admin/ecmscom.php path parameter.

References

qclover.github.io/2018/10/10/EmpireCMS_V7.5%E7%9A%84%E4%B8%80%E6%AC%A1%E5%AE%A1%E8%AE%A1.html · Exploit

More vulnerabilities in empirecms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

empirecms

phome

= 7.5

No fix yet

More vulnerabilities in empirecms

See all →