MEDIUM
Surreal ToDo 0.6.1.2 Local File Inclusion via index.php
Published Mar 6, 2026
6.9
MEDIUMCVSS 4.0
EPSS 0.81%
Description
Surreal ToDo 0.6.1.2 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the content parameter. Attackers can supply directory traversal sequences through the content parameter in index.php to access sensitive system files like configuration and initialization files.
Affected products
-
- Version 0.6.1.2StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Getsurreal | Surreal ToDo | n/a |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (3)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-21638 Advisory
- https://www.exploit-db.com/exploits/45826 exploit
- https://www.vulncheck.com/advisories/surreal-todo-local-file-inclusion-via-indexphp third-party-advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-21638 | Advisory | |
| https://www.exploit-db.com/exploits/45826 | exploit | |
| https://www.vulncheck.com/advisories/surreal-todo-local-file-inclusion-via-indexphp | third-party-advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published Mar 6, 2026
Updated Mar 9, 2026
Reserved Mar 6, 2026
Link CVE-2018-25184
CISA Vulnrichment
Updated Mar 9, 2026
ENISA EUVD
EUVD-2018-21638 Assigner VulnCheck
Published Mar 6, 2026
Updated Mar 9, 2026
Exploited since n/a
Link EUVD-2018-21638