Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

AuraCMS 3.0 filemanager.php lets attackers view any folder

CVE-2014-3975 · published 12 years ago
Summary

The filemanager.php page in AuraCMS version 3.0 can be tricked into showing the contents of any folder on the server when a specially crafted path is supplied. This could expose sensitive files to anyone on the internet. Apply the vendor's update or restrict access to the filemanager.php page until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
auracms auracms 3.0
cpe:2.3:a:auracms:auracms:3.0:*:*:*:*:*:*:*
Original advisory text
Absolute path traversal vulnerability in filemanager.php in AuraCMS 3.0 allows remote attackers to list a directory via a full pathname in the viewdir parameter.
Absolute path traversal vulnerability in filemanager.php in AuraCMS 3.0 allows remote attackers to list a directory via a full pathname in the viewdir parameter.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
7% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published5 Jun 2014
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2014-3975 · NVD
Track software like this
Free during beta