CVE-2026-63303

Published: Lug 28, 2026 Last Modified: Lug 28, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read contents of files located in the sibling directory of the webroot via a crafted HTTP request containing ../ sequences in the URI.

The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.

23

Relative Path Traversal

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands Modify Files Or Directories Read Files Or Directories Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies: Not Technology-Specific, Web Based, AI/ML
View CWE Details
https://cert.pl/en/posts/2026/07/CVE-2026-63301
https://cert.pl/en/posts/2026/07/CVE-2026-63301
https://opensolution.org/
https://opensolution.org/