frontaccounting faplanet path traversal
Priority MEDIUM 44CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability has been found in frontaccounting faplanet and classified as critical. This vulnerability affects unknown code. The manipulation leads to path traversal. The patch is identified as a5dcd87f46080a624b1a9ad4b0dd035bbd24ac50. It is recommended to apply a patch to fix this issue. VDB-218398 is the identifier assigned to this vulnerability.
Why it matters now
EPSS 0.00913 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FrontAccounting | faplanet | all versions | — | No fix listed | CNA |
- faplanet VendorFrontAccounting Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:faplanet_project:faplanet:*:*:*:*:*:*:*:* | before 2014-05-21 | Vulnerable | Faplanet Project |
- cpe:2.3:a:faplanet_project:faplanet:*:*:*:*:*:*:*:* Versions before 2014-05-21 Vulnerable ·Faplanet Project
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2014-125080
- 2026-10-03 Alias added: GHSA-8x5q-8c77-vq49
References
More FrontAccounting vulnerabilities
- TI-2026-29268 FrontAccounting < 2.4.20 Path Traversal RCE via attachment upload CVSS 4.0HIGH 8.7
- TI-2007-04142 PHP remote file inclusion vulnerability in config.php in FrontAccounting 1.12 Build 31… CVSS 2.0HIGH 7.5
- TI-2026-29271 FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions() CVSS 4.0HIGH 7.2
- TI-2026-29270 FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php CVSS 4.0HIGH 7.2
- TI-2026-29269 FrontAccounting < 2.4.20 SQL Injection via rep601.php CVSS 4.0HIGH 7.1
- TI-2007-04929 Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when… CVSS 2.0HIGH 9.3
Sources
- CVE-2014-125080 · CVE Program
- CVE-2014-125080 · NVD
- FIRST EPSS
- GHSA-8x5q-8c77-vq49 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences