{"uuid": "91a0a3b7-56df-46f4-99fb-85804c6f2bd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26601", "type": "seen", "source": "https://t.me/hacking_Attack/47293", "content": "Exploit Collector\nImpressCMS 1.4.2 Path Traversal\n\nhttps://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png \nImpressCMS versions 1.4.2 and below suffer from a path traversal vulnerability that can allow for arbitrary file deletion.\n\nMD5 | a8d22b7cc80f2dd7e1709f1422b1179e\n\nDownload\n-----------------------------------------------------------------\nImpressCMS <=\n-----------------------------------------------------------------\n[-] Software Link:\n\nhttps://www.impresscms.org\n[-] Affected Versions:\n\nVersion 1.4.2 and prior versions.\n[-] Vulnerability Description:\n\nThe vulnerability is located in the \n/libraries/image-editor/image-edit.php script:\n\n161.        if (@copy ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' . \n$simage_temp, $categ_path . $simage->getVar ( 'image_name' ) )) {\n162.            if (@unlink ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' . \n$simage_temp )) {\n163.                $msg = _MD_AM_DBUPDATED;\n\n[...]\n\n190.        } else {\n191.            if (copy ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' . \n$simage_temp, $categ_path . $imgname )) {\n192.                @unlink ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' . \n$simage_temp );\n193.            }\n\nUser input passed through the \"image_temp\" parameter is not properly \nsanitized before being used in a call to the unlink() function at lines \n162 and 192. This can be exploited by authenticated attackers to carry \nout Path Traversal attacks and delete arbitrary files in the context of \nthe web server process. This vulnerability could be exploited also to \ndisclose the content of arbitrary files in case the web server allows \nfor directory listing.\n\n[-] Solution:\n\nUpgrade to version 1.4.3 or later.\n[-] Disclosure Timeline:\n\n[19/01/2021] - Vendor notified through HackerOne\n[29/01/2021] - Vulnerability acknowledged by the vendor\n[03/02/2021] - CVE number assigned\n[06/02/2022] - Version 1.4.3 released\n[22/03/2022] - Public disclosure\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org)\nhas assigned the name CVE-2021-26601 to this vulnerability.\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n[-] Other References:\n\nhttps://hackerone.com/reports/1081878\n[-] Original Advisory:\n\nhttp://karmainsecurity.com/KIS-2022-02\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T01:00:35.147265Z"}