CVE-2018-25181

HIGH

7.5

Description

Musicco 2.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary directories by manipulating the parent parameter. Attackers can supply directory traversal sequences in the parent parameter of the getAlbum endpoint to access sensitive system directories and download them as ZIP files.

Details CVE

Score CVSS v3.17.5

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie3/6/2026

Derniere modification3/9/2026

Sourcenvd

Observations honeypot0

Faiblesses (CWE)

CWE-22

References

https://www.exploit-db.com/exploits/45830(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/musicco-arbitrary-directory-download-via-path-traversal(disclosure@vulncheck.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.