Executive brief
SSCMS, a content management system used for building and managing websites, contains a security flaw in its file download feature. An attacker can exploit this to access sensitive files on the server that should not be publicly available. This could lead to the exposure of configuration data or other internal system information, potentially aiding further attacks.
Technical details
A directory traversal vulnerability (CWE-27) exists in SSCMS v7.3.1 within the '/stl/actions/download' endpoint. The application fails to properly sanitize the 'filePath' input parameter, allowing a remote, unauthenticated attacker to use traversal sequences (e.g., ../) to access files outside of the intended directory. Successful exploitation enables the unauthorized download of sensitive system files and server information. The vulnerability was disclosed on August 5, 2025, and currently affects version 7.3.1.
Affected products
- SSCMS SSCMS 7.3.1
Timeline
- 2025-08-05: disclosed
- 2025-08-05: advisory