Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2007-2633: H‑Sphere SiteStudio 1.6 can expose local files
CVE-2007-2633 · published 19 years ago
Summary
The SiteStudio 1.6 web tool lets an attacker place ".." in a template request and gain access to any file on the server. This could reveal confidential information or allow malicious code to run. Apply the vendor's security update or block access to the template function until it is fixed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| positive_software | sitestudio |
1.6 cpe:2.3:a:positive_software:sitestudio:1.6:*:*:*:*:*:*:* |
Original advisory text
Directory traversal vulnerability in H-Sphere SiteStudio 1.6 allows remote attackers to read, or include and execute, arbitrary local files via a .. (dot dot) in the template parameter.
Directory traversal vulnerability in H-Sphere SiteStudio 1.6 allows remote attackers to read, or include and execute, arbitrary local files via a .. (dot dot) in the template parameter.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
10.0
Critical
Timeline
Published13 May 2007
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2007-2633 · NVD
Track software like this
Free during beta