CVE-2015-3648

Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2...

7.5 High

Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the defaultlanguage parameter.

Exploit likelihood

8.03%Up 6.8 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2015-3648
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-3648
Updated: 2026-11-02

EUVDEUVD-2015-3685 No score

Record: EUVD-2015-3685
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r6jw-4qph-m95f No score

Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2...

Record: GHSA-r6jw-4qph-m95f
Weakness: CWE-22
Updated: 2026-11-02

Affected products

montala resourcespace

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	ResourceSpace - Local File inclusion

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, Nuclei, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-3648 is a high vulnerability (CVSS 7.5) in Montala Resourcespace, published June 9, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.03%, the 94th percentile. No source names a fixed version.