Executive brief
Navigate CMS, an open-source content management system used for website administration, is vulnerable to a security flaw that allows logged-in users to access files they should not be able to see. By manipulating web requests, an attacker can download sensitive system files, such as configuration files containing database credentials or server settings. This could lead to a full compromise of the website's data and underlying server infrastructure.
Technical details
A path traversal vulnerability exists in Navigate CMS version 2.8.5 and earlier within the 'navigate_download.php' component. The application fails to properly sanitize the 'id' parameter in GET requests, allowing an authenticated user with at least 'User' profile privileges to use '../' sequences to escape the intended directory. An attacker can exploit this to read sensitive files outside the web root, such as 'cfg/globals.php' or system files like 'win.ini' or '/etc/passwd'. While the vulnerability requires authentication, it poses a significant risk of information disclosure that can facilitate further attacks. Newer versions of Navigate CMS (e.g., 2.9.x) are available and should be used to mitigate this risk.
Affected products
- Naviwebs Navigate CMS 2.8.5 and earlier
Timeline
- 2018-10-13: disclosed: Initial discovery and proof of concept by researcher Ihsan Sencan
- 2018-10-16: other: Exploit published on Exploit-DB
- 2026-05-29: advisory: CVE record published/updated via VulnCheck