{"id":"CVE-2015-4632","aliases":["EUVD-2015-4651","GHSA-7f22-j94q-hwmh"],"status":"published","title":"Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12...","description":"Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path parameter to (1) svc/virtualshelves/search or (2) svc/members/search.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.51829,"percentile":0.98958,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2018-10-18T20:00:00Z","modified":"2026-06-17T00:27:38Z","exploits":[{"source":"exploitdb","id":"EDB-37388","title":"Koha 3.20.1 - Directory Traversal","type":"webapps","platform":"php","date":"2015-06-26","url":"https://www.exploit-db.com/exploits/37388"},{"source":"nuclei","id":"CVE-2015-4632","title":"Koha 3.20.1 - Directory Traversal","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-4632.yaml"}],"products":[{"vendor":"koha","product":"koha"}],"references":[{"url":"https://packetstormsecurity.com/files/132458/Koha-ILS-3.20.x-CSRF-XSS-Traversal-SQL-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.sba-research.org/2015/06/24/researchers-of-sba-research-found-several-critical-security-vulnerabilities-in-the-koha-library-software-via-combinatorial-testing/","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory"]},{"url":"https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://koha-community.org/security-release-koha-3-16-12/","tags":["x_refsource_CONFIRM","x_transferred","Release Notes"]},{"url":"https://seclists.org/fulldisclosure/2015/Jun/80","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://koha-community.org/security-release-koha-3-18-8/","tags":["x_refsource_CONFIRM","x_transferred","Release Notes"]},{"url":"https://koha-community.org/security-release-koha-3-20-1/","tags":["x_refsource_CONFIRM","x_transferred","Release Notes"]},{"url":"https://www.exploit-db.com/exploits/37388/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://koha-community.org/koha-3-14-16-released/","tags":["x_refsource_CONFIRM","x_transferred","Release Notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-4632"},{"url":"https://github.com/advisories/GHSA-7f22-j94q-hwmh"}],"sources":{"cve":[{"id":"CVE-2015-4632","description":"Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path parameter to (1) svc/virtualshelves/search or (2) svc/members/search.","status":"published","published":"2018-10-18T20:00:00Z","modified":"2024-08-06T06:18:12.033Z","updated_at":"2026-11-02T14:35:43.322279Z"}],"euvd":[{"id":"EUVD-2015-4651","description":"Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path parameter to (1) svc/virtualshelves/search or (2) svc/members/search.","status":"published","published":"2018-10-18T20:00:00Z","modified":"2024-08-06T06:18:12Z","updated_at":"2026-11-03T02:22:03.142599Z"}],"ghsa":[{"id":"GHSA-7f22-j94q-hwmh","title":"Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12...","description":"Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path parameter to (1) svc/virtualshelves/search or (2) svc/members/search.","status":"published","published":"2022-05-14T01:44:13Z","modified":"2023-02-02T05:04:25Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:51:52.184259Z"}],"nvd":[{"id":"CVE-2015-4632","description":"Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path parameter to (1) svc/virtualshelves/search or (2) svc/members/search.","status":"published","published":"2018-10-18T21:29:01.333Z","modified":"2026-06-17T00:27:38.18Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:03:19.73542Z"}]}}