{"id":"CVE-2018-13864","aliases":["EUVD-2022-5280","GHSA-v4mq-p756-p4f5"],"status":"published","title":"Play Framework's Assets controller vulnerable to directory traversal","description":"A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03418,"percentile":0.8898,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2018-07-17T12:00:00Z","modified":"2026-10-24T10:30:32Z","exploits":[{"source":"pocgithub","id":"tafamace/CVE-2018-13864","title":"tafamace/CVE-2018-13864","date":"2018-11-19","url":"https://github.com/tafamace/CVE-2018-13864"}],"fixes":[{"ecosystem":"Maven","package":"com.typesafe.play:play_2.12","fixed_in":["2.6.16"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.typesafe.play:play_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.12"},{"fixed":"2.6.16"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.typesafe.play:play_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.12"},{"fixed":"2.6.16"}]}],"versions":["2.6.12","2.6.13","2.6.14","2.6.15"]}],"products":[{"vendor":"lightbend","product":"play_framework"}],"references":[{"url":"https://www.playframework.com/security/vulnerability/CVE-2018-13864-PathTraversal","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-13864","tags":["advisory"]},{"url":"https://discuss.lightbend.com/t/play-2-6-16-released/1575","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v4mq-p756-p4f5"}],"sources":{"cve":[{"id":"CVE-2018-13864","description":"A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.","status":"published","published":"2018-07-17T12:00:00Z","modified":"2024-08-05T09:14:47.422Z","updated_at":"2026-11-02T14:35:07.01498Z"}],"euvd":[{"id":"EUVD-2022-5280","description":"A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.","status":"published","published":"2018-07-17T12:00:00Z","modified":"2024-08-05T09:14:47Z","updated_at":"2026-11-03T02:39:48.313733Z"}],"ghsa":[{"id":"GHSA-v4mq-p756-p4f5","title":"Play Framework's Assets controller vulnerable to directory traversal","description":"A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.","status":"published","published":"2022-05-13T01:30:27Z","modified":"2023-02-02T05:01:23Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:39.76883Z"}],"nvd":[{"id":"CVE-2018-13864","description":"A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.","status":"published","published":"2018-07-17T12:29:00.23Z","modified":"2026-06-17T01:40:17.113Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:04:32.929986Z"}],"osv":[{"id":"CVE-2018-13864","description":"A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.","status":"published","published":"2018-07-17T12:29:00.23Z","modified":"2026-10-24T10:30:32.559347314Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"GHSA-v4mq-p756-p4f5","title":"Play Framework's Assets controller vulnerable to directory traversal","description":"A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.","status":"published","published":"2022-05-13T01:30:27Z","modified":"2023-11-08T03:59:54.48598Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:56.639206Z"}]}}