CVE-2008-6658
Severity CVSS v4.0:
Pending analysis
Type:
CWE-22
Path Traversal
Publication date:
07/04/2009
Last modified:
09/04/2025
Description
Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. (dot dot) in the package parameter during an install2 action, as demonstrated by a predictable package filename in attachments/ that was uploaded through a post2 action to index.php.
Impact
Base Score 2.0
4.00
Severity 2.0
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:simple_machines:simple_machines_forum:1.0.5:*:*:*:*:*:*:* | ||
| cpe:2.3:a:simple_machines:simple_machines_forum:1.0.6:*:*:*:*:*:*:* | ||
| cpe:2.3:a:simple_machines:simple_machines_forum:1.0.7:*:*:*:*:*:*:* | ||
| cpe:2.3:a:simple_machines:simple_machines_forum:1.0.11:*:*:*:*:*:*:* | ||
| cpe:2.3:a:simple_machines:simple_machines_forum:1.0.12:*:*:*:*:*:*:* | ||
| cpe:2.3:a:simple_machines:simple_machines_forum:1.1.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:simple_machines:simple_machines_forum:1.1.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:simple_machines:simple_machines_forum:1.1.3:*:*:*:*:*:*:* | ||
| cpe:2.3:a:simple_machines:simple_machines_forum:1.1.4:*:*:*:*:*:*:* | ||
| cpe:2.3:a:simple_machines:simple_machines_forum:1.1.5:*:*:*:*:*:*:* | ||
| cpe:2.3:a:simple_machines:simple_machines_forum:1.1.6:*:*:*:*:*:*:* | ||
| cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc3:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page