Read the docs
TI-2018-16195 Aliases CVE-2018-25439GHSA-f89h-c9q7-hw4h

Path traversal in MetInfo CMS lets attackers read files

Priority HIGH 71CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

MetInfo CMS from 6.0.0 before 6.1.1 contains a path traversal flaw (CWE-22) in the dir parameter of /include/thumb.php. An unauthenticated remote attacker can read arbitrary files on the server. A public exploit is linked in the references, and the Shadowserver Foundation first observed exploitation on 2023-10-14.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00469 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed MetInfo (MetInfo): 6.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MetInfoMetInfo6.0.0 to before 6.1.16.1.1Patch availableCNA
  • MetInfo VendorMetInfo Affected 6.0.0 to before 6.1.1 Fixed in 6.1.1 Patch available CNA

Remediation

Update MetInfo CMS to version 6.1.1, the fixed version. The sources list no fixed version for any other release line.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA MetInfo (MetInfo) Fixed in 6.1.1

Timeline

  1. 2026-10-22 Threatist record created from CVE-2018-25439
  2. 2026-10-22 Alias added: GHSA-f89h-c9q7-hw4h
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-29 CISA SSVC decision points changed
  5. 2026-10-29 Priority changed: LOW → HIGH

References

Exploit 1

Other 2

  • TI-2026-23179 MetInfo CMS Unauthenticated PHP Code Injection RCE CVSS 4.0CRITICAL 9.3
  • TI-2022-22075 A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows… CVSS 3.1HIGH 8.8
  • TI-2025-39366 A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External… CVSS 3.1HIGH 7.5
  • TI-2025-37677 A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS… CVSS 3.1MEDIUM 6.1
  • TI-2019-13007 An issue was discovered in MetInfo 7.0. CVSS 3.1HIGH 7.2
  • TI-2019-12682 In Metinfo 7.0.0beta, a SQL Injection was discovered in… CVSS 3.1HIGH 7.2
See all 60 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences