Vulnerabilities

TI-2016-09199 CVE-2016-20023 · GHSA-fv5g-wf76-67g3

Path traversal in CKSource CKFinder

LOW 29

In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00368 Published 2025-12-05 Fixed in 2.5.0.1 CWE-23

TI-2025-39467 CVE-2025-63830 · GHSA-2xcq-fmvr-mmpw

CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function.

MEDIUM 60

CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00266 Published 2025-11-14 No fix listed CWE-79

TI-2019-11943 CVE-2019-15891 · GHSA-fgxv-jr36-jj9w

An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0.

LOW 26

An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01093 Published 2019-09-26 No fix listed CWE-200

TI-2019-11922 CVE-2019-15862 · GHSA-jfrg-795f-64q8

An issue was discovered in CKFinder through 2.6.2.1.

LOW 36

An issue was discovered in CKFinder through 2.6.2.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01523 Published 2019-09-26 No fix listed CWE-434

Vulnerabilities

Filters

Path traversal in CKSource CKFinder

CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function.

An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0.

An issue was discovered in CKFinder through 2.6.2.1.