Read the docs
TI-2019-15230 Aliases CVE-2019-25097GHSA-3j4x-wh8q-39g3

soerennb eXtplorer Directory Content path traversal

Priority MEDIUM 44CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability was found in soerennb eXtplorer up to 2.1.12 and classified as critical. Affected by this issue is some unknown functionality of the component Directory Content Handler. The manipulation leads to path traversal. Upgrading to version 2.1.13 is able to address this issue. The name of the patch is b8fcb888f4ff5e171c16797a4b075c6c6f50bf46. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217436.

Why it matters now

EPSS 0.01111 66th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
soerennbeXtplorer2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; 2.1.6; 2.1.7; 2.1.8; 2.1.9; 2.1.10; 2.1.11; 2.1.12—No fix listedCNA
  • eXtplorer Vendorsoerennb Affected 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; 2.1.6; 2.1.7; 2.1.8; 2.1.9; 2.1.10; 2.1.11; 2.1.12 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:extplorer:extplorer:*:*:*:*:*:*:*:*before 2.1.13Vulnerablesoerennb
  • cpe:2.3:a:extplorer:extplorer:*:*:*:*:*:*:*:* Versions before 2.1.13 Vulnerable ·soerennb

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-25097
  2. 2026-10-03 Alias added: GHSA-3j4x-wh8q-39g3

References

Patch 2

  • TI-2023-30609 eXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE) CVSS 4.0CRITICAL 9.3
  • TI-2023-12441 Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15… CVSS 3.1HIGH 8.8
  • TI-2012-05412 ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication… CVSS 3.0CRITICAL 9.8
  • TI-2025-11943 soerennb eXtplorer Filename cross site scripting CVSS 4.0MEDIUM 5.1
  • TI-2019-05193 eXtplorer exposes /usr and /etc/extplorer over HTTP CVSS 3.1CRITICAL 9.8
  • TI-2016-03698 Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows… CVSS 3.0HIGH 7.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences