Read the docs
TI-2023-01126 Aliases CVE-2023-1191GHSA-cw45-5qrw-cf7x

fastcms ZIP File TemplateController.java path traversal

Priority LOW 33CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability classified as problematic has been found in fastcms. This affects an unknown part of the file admin/TemplateController.java of the component ZIP File Handler. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-222363.

Why it matters now

EPSS 0.00908 60th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—fastcmsall versions—No fix listedCNA
  • fastcms Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xjd2020:fastcms:-:*:*:*:*:*:*:*not specified by NVDVulnerableXjd2020
  • cpe:2.3:a:xjd2020:fastcms:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Xjd2020

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1191
  2. 2026-10-03 Alias added: GHSA-cw45-5qrw-cf7x

References

Exploit 2

  • TI-2022-03938 FastCMS Template edit injection CVSS 3.1HIGH 8.8
  • TI-2026-21344 An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via… CVSS 3.1HIGH 7.8
  • TI-2025-02261 FastCMS list sql injection CVSS 4.0MEDIUM 5.3
  • TI-2024-07168 FastCMS New Article Category Page cross site scripting CVSS 4.0MEDIUM 5.3
  • TI-2023-01051 FastCMS New Article Tab cross site scripting CVSS 4.0MEDIUM 5.1
  • TI-2025-01143 FastCMS Template Menu menu cross site scripting CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences