{"id":"CVE-2020-5237","aliases":["EUVD-2020-0321","GHSA-x8wj-6m73-gfqp"],"status":"published","title":"Relative Path Traversal in oneup/uploader-bundle","description":"Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files on the filesystem (potentially leading to arbitrary code execution) via the (1) filename parameter to BlueimpController.php; the (2) dzchunkindex, (3) dzuuid, or (4) filename parameter to DropzoneController.php; the (5) qqpartindex, (6) qqfilename, or (7) qquuid parameter to FineUploaderController.php; the (8) x-file-id or (9) x-file-name parameter to MooUploadController.php; or the (10) name or (11) chunk parameter to PluploadController.php. This is fixed in versions 1.9.3 and 2.1.5.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.03929,"percentile":0.90499,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-23"],"published":"2020-02-05T13:55:16Z","modified":"2026-10-20T10:54:22Z","fixes":[{"ecosystem":"Packagist","package":"oneup/uploader-bundle","fixed_in":["2.1.5","1.9.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"oneup/uploader-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"oneup/uploader-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.9.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"oneup/uploader-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.5"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4"]},{"source":"osv","ecosystem":"Packagist","package":"oneup/uploader-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.9.3"}]}],"versions":["1.3.2","1.4.0","1.5.0","1.6.0","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.8.0","1.8.1","1.8.2","1.8.3","1.9.0","1.9.1","1.9.2","v1.0.0","v1.0.1","v1.1.0","v1.2.0","v1.2.1","v1.2.2","v1.3.0","v1.3.1"]}],"products":[{"vendor":"1up","product":"oneupuploaderbundle"},{"vendor":"1up-lab","product":"oneup/uploader-bundle"}],"references":[{"url":"https://github.com/1up-lab/OneupUploaderBundle/security/advisories/GHSA-x8wj-6m73-gfqp","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/1up-lab/OneupUploaderBundle/commit/a6011449b716f163fe1ae323053077e59212350c","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-003.txt","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5237","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/oneup/uploader-bundle/CVE-2020-5237.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x8wj-6m73-gfqp"}],"sources":{"cve":[{"id":"CVE-2020-5237","title":"Relative Path Traversal in oneup/uploader-bundle","description":"Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files on the filesystem (potentially leading to arbitrary code execution) via the (1) filename parameter to BlueimpController.php; the (2) dzchunkindex, (3) dzuuid, or (4) filename parameter to DropzoneController.php; the (5) qqpartindex, (6) qqfilename, or (7) qquuid parameter to FineUploaderController.php; the (8) x-file-id or (9) x-file-name parameter to MooUploadController.php; or the (10) name or (11) chunk parameter to PluploadController.php. This is fixed in versions 1.9.3 and 2.1.5.","status":"published","published":"2020-02-05T13:55:16Z","modified":"2024-08-04T08:22:09.051Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:35:47.877975Z"}],"euvd":[{"id":"EUVD-2020-0321","description":"Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files on the filesystem (potentially leading to arbitrary code execution) via the (1) filename parameter to BlueimpController.php; the (2) dzchunkindex, (3) dzuuid, or (4) filename parameter to DropzoneController.php; the (5) qqpartindex, (6) qqfilename, or (7) qquuid parameter to FineUploaderController.php; the (8) x-file-id or (9) x-file-name parameter to MooUploadController.php; or the (10) name or (11) chunk parameter to PluploadController.php. This is fixed in versions 1.9.3 and 2.1.5.","status":"published","published":"2020-02-05T13:55:16Z","modified":"2024-08-04T08:22:09Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:08:07.28588Z"}],"ghsa":[{"id":"GHSA-x8wj-6m73-gfqp","title":"Relative Path Traversal (CWE-23) in chunked uploads in oneup/uploader-bundle","description":"### Impact\nThe vulnerability was identified in the web service for a chunked file\nupload. While the names of the POST parameters vary with the used\nfrontend, their values are always used in the same way to build a path\nwhere the chunks are stored and assembled temporarily. By not validating\nthese parameters properly, OneupUploaderBundle is susceptible to a path\ntraversal vulnerability which can be exploited to upload files to\narbitrary folders on the filesystem. The assembly process can further be\nmisused with some restrictions to delete and copy files to other\nlocations.\n\nThe vulnerability can be exploited by any users that have legitimate\naccess to the upload functionality and can lead to arbitrary code\nexecution, denial of service and disclosure of confidential information.\n\n### Patches\nYes, see version 1.9.3 and 2.1.5.\n\n### References\nhttps://owasp.org/www-community/attacks/Path_Traversal\n\n### Credits:\nThis security vulnerability was found by Thibaud Kehler of SySS GmbH.\nE-Mail: thibaud.kehler@syss.de","status":"published","published":"2020-02-18T18:59:24Z","modified":"2024-02-07T18:14:32Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-23"],"updated_at":"2026-11-02T14:37:36.076201Z"}],"nvd":[{"id":"CVE-2020-5237","description":"Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files on the filesystem (potentially leading to arbitrary code execution) via the (1) filename parameter to BlueimpController.php; the (2) dzchunkindex, (3) dzuuid, or (4) filename parameter to DropzoneController.php; the (5) qqpartindex, (6) qqfilename, or (7) qquuid parameter to FineUploaderController.php; the (8) x-file-id or (9) x-file-name parameter to MooUploadController.php; or the (10) name or (11) chunk parameter to PluploadController.php. This is fixed in versions 1.9.3 and 2.1.5.","status":"published","published":"2020-02-05T14:15:11.527Z","modified":"2026-06-17T03:21:06.3Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-23","CWE-22"],"updated_at":"2026-11-02T14:05:53.837808Z"}],"osv":[{"id":"CVE-2020-5237","description":"Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files on the filesystem (potentially leading to arbitrary code execution) via the (1) filename parameter to BlueimpController.php; the (2) dzchunkindex, (3) dzuuid, or (4) filename parameter to DropzoneController.php; the (5) qqpartindex, (6) qqfilename, or (7) qquuid parameter to FineUploaderController.php; the (8) x-file-id or (9) x-file-name parameter to MooUploadController.php; or the (10) name or (11) chunk parameter to PluploadController.php. This is fixed in versions 1.9.3 and 2.1.5.","status":"published","published":"2020-02-05T14:15:11.527Z","modified":"2026-10-20T10:54:22.601420293Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"GHSA-x8wj-6m73-gfqp","title":"Relative Path Traversal (CWE-23) in chunked uploads in oneup/uploader-bundle","description":"### Impact\nThe vulnerability was identified in the web service for a chunked file\nupload. While the names of the POST parameters vary with the used\nfrontend, their values are always used in the same way to build a path\nwhere the chunks are stored and assembled temporarily. By not validating\nthese parameters properly, OneupUploaderBundle is susceptible to a path\ntraversal vulnerability which can be exploited to upload files to\narbitrary folders on the filesystem. The assembly process can further be\nmisused with some restrictions to delete and copy files to other\nlocations.\n\nThe vulnerability can be exploited by any users that have legitimate\naccess to the upload functionality and can lead to arbitrary code\nexecution, denial of service and disclosure of confidential information.\n\n### Patches\nYes, see version 1.9.3 and 2.1.5.\n\n### References\nhttps://owasp.org/www-community/attacks/Path_Traversal\n\n### Credits:\nThis security vulnerability was found by Thibaud Kehler of SySS GmbH.\nE-Mail: thibaud.kehler@syss.de","status":"published","published":"2020-02-18T18:59:24Z","modified":"2026-09-10T03:48:27.619057563Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-23"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}