CVE-2019-25574 - Green CMS 2.x Path Traversal Arbitrary File Download

Back Back to CVE browser

HIGH

Green CMS 2.x Path Traversal Arbitrary File Download

Published Mar 21, 2026

7.1

HIGH

CVSS 4.0

EPSS 1.10%

Description

Green CMS 2.x contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files and directories by injecting directory traversal sequences. Attackers can manipulate the theme_name parameter in the themeexporthandle action or supply base64-encoded file paths to the downfile action to retrieve sensitive files outside intended directories.

Affected products

Vendor Greencms Product Green CMS Default
n/a
- Version
  2.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Greencms

Green CMS

n/a

Version	Status	Constraints
2.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (4)

http://www.greencms.net/
productBroken Link
https://codeload.github.com/GreenCMS/GreenCMS/zip/beta
product
https://www.exploit-db.com/exploits/46245
exploitThird Party AdvisoryVDB Entry
https://www.vulncheck.com/advisories/green-cms-2-x-path-traversal-arbitrary-file-download
third-party-advisoryThird Party Advisory

Link	Providers	Tags
http://www.greencms.net/		productBroken Link
https://codeload.github.com/GreenCMS/GreenCMS/zip/beta		product
https://www.exploit-db.com/exploits/46245		exploitThird Party AdvisoryVDB Entry
https://www.vulncheck.com/advisories/green-cms-2-x-path-traversal-arbitrary-file-download		third-party-advisoryThird Party Advisory