CVE-2016-15017

CRITICO 9.8CVE-2016-15017 · Published 10/01/2023 · updated 17/06/2026

In breve

CVE-2016-15017 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda media upload (ecodev).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.90%, superiore al 59.8% delle vulnerabilità.
Correzione: aggiornare a 0.9.0 o successiva.

Package	Affected versions	Patched versions
media upload ecodev	`< 0.9.0`	`0.9.0`

Description

A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname traversal. Upgrading to version 0.9.0 is able to address this issue. The patch is identified as b25d42a4981072321c1a363311d8ea2a4ac8763a. It is recommended to upgrade the affected component. VDB-217786 is the identifier assigned to this vulnerability.

References

fabarea/media_upload commit b25d42a · Patch
fabarea/media_upload · Third Party Advisory
fabarea/media_upload release 0.9.0 · Third Party Advisory
vuldb.com · Third Party Advisory
vuldb.com · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free