CVE-2026-63303

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read contents of files located in the sibling directory of the webroot via a crafted HTTP request containing ../ sequences in the URI. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/07/CVE-2026-63301
https://opensolution.org/

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de salto de ruta existe en Quick.CMS a través del componente de ruta URI de las solicitudes HTTP, donde el servidor no normaliza las secuencias de punto-punto-barra (.. / ) antes de resolver y servir el archivo solicitado. Un atacante autenticado con privilegios de administrador puede usar esta vulnerabilidad para leer el contenido de archivos ubicados en el directorio hermano del webroot a través de una solicitud HTTP manipulada que contiene secuencias .. / en la URI. El proveedor evaluó la probabilidad de explotación como muy baja y determinó que una solución no es necesaria.

Information

Published : 2026-07-28 11:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-63303

Mitre link : CVE-2026-63303

CVE.ORG link : CVE-2026-63303

JSON object : View

Products Affected

No product.

CWE

CWE-23

Relative Path Traversal

{"id": "CVE-2026-63303", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63303", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T12:20:47.511436Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "OpenSolution", "product": "Quick.CMS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.8.0"}], "defaultStatus": "unknown"}]}], "published": "2026-07-28T11:17:04.100", "references": [{"url": "https://cert.pl/en/posts/2026/07/CVE-2026-63301", "source": "cvd@cert.pl"}, {"url": "https://opensolution.org/", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences before resolving and serving the requested file. An authenticated attacker with admin privileges\u00a0can use this vulnerability to read contents of files located in the sibling directory of the webroot via a crafted HTTP request containing ../ sequences in the URI.\n\n\nThe vendor assessed the likelihood of exploitation as very low and determined that a fix is\u00a0not necessary."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta existe en Quick.CMS a trav\u00e9s del componente de ruta URI de las solicitudes HTTP, donde el servidor no normaliza las secuencias de punto-punto-barra (.. / ) antes de resolver y servir el archivo solicitado. Un atacante autenticado con privilegios de administrador puede usar esta vulnerabilidad para leer el contenido de archivos ubicados en el directorio hermano del webroot a trav\u00e9s de una solicitud HTTP manipulada que contiene secuencias .. / en la URI.\n\nEl proveedor evalu\u00f3 la probabilidad de explotaci\u00f3n como muy baja y determin\u00f3 que una soluci\u00f3n no es necesaria."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "cvd@cert.pl"}