Executive brief
HUBzero CMS is an open-source collaboration platform used by research institutions and scientific communities. A path traversal vulnerability in its file upload handler allows authenticated project members to write arbitrary files outside the intended project directory with web server privileges, potentially leading to remote code execution and full system compromise.
Technical details
The vulnerability exists in the project file upload handlers (filesv1_0.php controller) and is caused by insufficient path sanitization in the upload parameter processing. An authenticated project member can supply traversal sequences (e.g., "../../../") to write files to arbitrary locations on the server. The vulnerability requires prior authentication and project member access, but no additional user interaction. An attacker can achieve remote code execution by uploading a PHP shell or other executable files to web-accessible directories, gaining execution with the web server's privileges. The issue affects HUBzero CMS through version 2.2.32.
Affected products
- HUBzero CMS through 2.2.32
Timeline
- 2026-09-17: disclosed