CVE-2023-2059

Deeper analysis

A vulnerability rated problematic exists in DedeCMS version 5.7.87 within the file uploads/include/dialog/select_templets.php. The issue stems from improper handling of input that permits path traversal using sequences such as '..\filedir', classified under CWE-28. It carries a CVSS 4.3 score reflecting network attack vector, low complexity, and low-privileged access without user interaction, resulting in limited availability impact but no loss of confidentiality or integrity.

An authenticated remote attacker can exploit the flaw to traverse directories on the server. Publicly disclosed proof-of-concept code demonstrates that the manipulation can be performed over the network, potentially allowing disruption of service through targeted file operations.

The provided references consist of vulnerability database entries and a GitHub repository containing exploit details, with no advisory or patch information included. The EPSS score has remained flat at 0.0571 with no observed increase after disclosure.