Read the docs
TI-2020-04293 Aliases CVE-2020-5237GHSA-x8wj-6m73-gfqp

Relative Path Traversal in oneup/uploader-bundle

Priority MEDIUM 45CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files on the filesystem (potentially leading to arbitrary code execution) via the (1) filename parameter to BlueimpController.php; the (2) dzchunkindex, (3) dzuuid, or (4) filename parameter to DropzoneController.php; the (5) qqpartindex, (6) qqfilename, or (7) qquuid parameter to FineUploaderController.php; the (8) x-file-id or (9) x-file-name parameter to MooUploadController.php; or the (10) name or (11) chunk parameter to PluploadController.php. This is fixed in versions 1.9.3 and 2.1.5.

Why it matters now

EPSS 0.03929 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed oneup/uploader-bundle (1up-lab): 1.9.3, 2.1.5oneup/uploader-bundle (Packagist): 2.1.5, 1.9.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
1up-laboneup/uploader-bundlebefore 1.9.3; 2.0.0 to before 2.1.51.9.3, 2.1.5Patch availableCNA
—oneup/uploader-bundle (Packagist)2.0.0 to before 2.1.52.1.5Patch availableGHSA-x8wj-6m73-gfqp
—oneup/uploader-bundle (Packagist)1.0.0 to before 1.9.31.9.3Patch availableGHSA-x8wj-6m73-gfqp
  • oneup/uploader-bundle Vendor1up-lab Affected before 1.9.3; 2.0.0 to before 2.1.5 Fixed in 1.9.3, 2.1.5 Patch available CNA
  • oneup/uploader-bundle (Packagist) Vendor— Affected 2.0.0 to before 2.1.5 Fixed in 2.1.5 Patch available GHSA-x8wj-6m73-gfqp
  • oneup/uploader-bundle (Packagist) Vendor— Affected 1.0.0 to before 1.9.3 Fixed in 1.9.3 Patch available GHSA-x8wj-6m73-gfqp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:1up:oneupuploaderbundle:*:*:*:*:*:*:*:*before 1.9.3; 1.9.4 to before 2.1.5Vulnerable1up
  • cpe:2.3:a:1up:oneupuploaderbundle:*:*:*:*:*:*:*:* Versions before 1.9.3; 1.9.4 to before 2.1.5 Vulnerable ·1up

Remediation

  • Fix · CNA oneup/uploader-bundle (1up-lab) Fixed in 1.9.3, 2.1.5
  • Fix · GHSA-x8wj-6m73-gfqp oneup/uploader-bundle (Packagist) Fixed in 2.1.5 Advisory →
  • Fix · GHSA-x8wj-6m73-gfqp oneup/uploader-bundle (Packagist) Fixed in 1.9.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5237
  2. 2026-10-03 Alias added: GHSA-x8wj-6m73-gfqp

References

Exploit 1

Patch 1

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences