Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Z-BlogPHP 1.5.1 reveals server file path to attackers

CVE-2018-6846 · published 8 years ago
Summary

The Z-BlogPHP blog software version 1.5.1 can be tricked into showing the full directory path on the web server when a specific file is requested. Knowing the exact file locations helps attackers plan further attacks against the site. Update to a newer version or apply the vendor's patch to stop the path disclosure.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
zblogcn z-blogphp 1.5.1
cpe:2.3:a:zblogcn:z-blogphp:1.5.1:*:*:*:*:*:*:*
Original advisory text
Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zb_system/function/lib/upload.php.
Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zb_system/function/lib/upload.php.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published8 Feb 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-6846 · NVD
Track software like this
Free during beta