| Package | Affected versions | Patched versions |
|---|---|---|
| vtiger crm | ≤ 6.0.0 |
Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter in a download action. NOTE: it is likely that this issue is actually in the KCFinder third-party component, and it affects additional products besides Vtiger CRM.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free