CVE-2021-47751 - CuteEditor for PHP 6.6 - Directory Traversal

Back Back to CVE browser

MEDIUM

CuteEditor for PHP 6.6 - Directory Traversal

Published Jan 13, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.83%

Description

CuteEditor for PHP (now referred to as Rich Text Editor) 6.6 contains a directory traversal vulnerability in the browse template feature that allows attackers to write files to arbitrary web root directories. Attackers can exploit the ServerMapPath() function by renaming uploaded HTML files using directory traversal sequences to write files outside the intended template directory.

Affected products

Vendor Phphtmledit Product CuteEditor Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=6.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Phphtmledit

CuteEditor

n/a

Version	Status	Constraints
0	affected	<=6.6

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

http://phphtmledit.com/
product
https://www.exploit-db.com/exploits/50994
exploit
https://www.vulncheck.com/advisories/cuteeditor-for-php-directory-traversal
third-party-advisoryThird Party Advisory

Link	Providers	Tags
http://phphtmledit.com/		product
https://www.exploit-db.com/exploits/50994		exploit
https://www.vulncheck.com/advisories/cuteeditor-for-php-directory-traversal		third-party-advisoryThird Party Advisory