CVE-2018-25002

HIGH 8.8CVE-2018-25002 · Published 01/01/2021 · updated 17/06/2026

In short

CVE-2018-25002 is a HIGH (CVSS 8.8) vulnerability affecting kcfinder (sunhater).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
kcfinder sunhater	`≤ 2018-06-01`	No fix yet

Description

uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles validation, aka SA-CONTRIB-2018-024. NOTE: This project is not covered by Drupal's security advisory policy.

References

drupal.org/project/kcfinder/issues/1768718 · Third Party Advisory
drupal.org/project/kcfinder/issues/1768720 · Third Party Advisory
drupal.org/sa-contrib-2018-024 · Third Party Advisory

More vulnerabilities in kcfinder

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free