Read the docs
TI-2019-15231 Aliases CVE-2019-25098GHSA-mj4g-q8gh-hp8q

soerennb eXtplorer Archive archive.php path traversal

Priority MEDIUM 44CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability was found in soerennb eXtplorer up to 2.1.12. It has been classified as critical. This affects an unknown part of the file include/archive.php of the component Archive Handler. The manipulation leads to path traversal. Upgrading to version 2.1.13 is able to address this issue. The identifier of the patch is b8fcb888f4ff5e171c16797a4b075c6c6f50bf46. It is recommended to upgrade the affected component. The identifier VDB-217437 was assigned to this vulnerability.

Why it matters now

EPSS 0.01102 65th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
soerennbeXtplorer2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; 2.1.6; 2.1.7; 2.1.8; 2.1.9; 2.1.10; 2.1.11; 2.1.12—No fix listedCNA
  • eXtplorer Vendorsoerennb Affected 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; 2.1.6; 2.1.7; 2.1.8; 2.1.9; 2.1.10; 2.1.11; 2.1.12 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:extplorer:extplorer:*:*:*:*:*:*:*:*before 2.1.13Vulnerablesoerennb
  • cpe:2.3:a:extplorer:extplorer:*:*:*:*:*:*:*:* Versions before 2.1.13 Vulnerable ·soerennb

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-25098
  2. 2026-10-03 Alias added: GHSA-mj4g-q8gh-hp8q

References

Patch 2

  • TI-2023-30609 eXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE) CVSS 4.0CRITICAL 9.3
  • TI-2023-12441 Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15… CVSS 3.1HIGH 8.8
  • TI-2012-05412 ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication… CVSS 3.0CRITICAL 9.8
  • TI-2025-11943 soerennb eXtplorer Filename cross site scripting CVSS 4.0MEDIUM 5.1
  • TI-2019-05193 eXtplorer exposes /usr and /etc/extplorer over HTTP CVSS 3.1CRITICAL 9.8
  • TI-2016-03698 Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows… CVSS 3.0HIGH 7.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences