{"id":"CVE-2020-9364","aliases":["EUVD-2020-30185","GHSA-8c7v-p9q4-7x63"],"status":"published","title":"An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before...","description":"An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!. A directory traversal vulnerability resides in the filename field for uploaded attachments via the creativecontactform_upload parameter. An attacker could exploit this vulnerability with the \"Send me a copy\" option to receive any files of the filesystem via email.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03147,"percentile":0.88019,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2020-03-04T15:58:23Z","modified":"2026-06-17T03:27:49Z","products":[{"vendor":"creative-solutions","product":"creative_contact_form"}],"references":[{"url":"https://extensions.joomla.org/extension/creative-contact-form/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20200301-01/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2020/Mar/13","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/156655/Creative-Contact-Form-4.6.2-Directory-Traversal.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9364"},{"url":"https://github.com/advisories/GHSA-8c7v-p9q4-7x63"}],"sources":{"cve":[{"id":"CVE-2020-9364","description":"An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!. A directory traversal vulnerability resides in the filename field for uploaded attachments via the creativecontactform_upload parameter. An attacker could exploit this vulnerability with the \"Send me a copy\" option to receive any files of the filesystem via email.","status":"published","published":"2020-03-04T15:58:23Z","modified":"2024-08-04T10:26:16.083Z","updated_at":"2026-11-02T14:35:49.538427Z"}],"euvd":[{"id":"EUVD-2020-30185","description":"An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!. A directory traversal vulnerability resides in the filename field for uploaded attachments via the creativecontactform_upload parameter. An attacker could exploit this vulnerability with the \"Send me a copy\" option to receive any files of the filesystem via email.","status":"published","published":"2020-03-04T15:58:23Z","modified":"2024-08-04T10:26:16Z","updated_at":"2026-11-03T03:07:54.025234Z"}],"ghsa":[{"id":"GHSA-8c7v-p9q4-7x63","title":"An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before...","description":"An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!. A directory traversal vulnerability resides in the filename field for uploaded attachments via the creativecontactform_upload parameter. An attacker could exploit this vulnerability with the \"Send me a copy\" option to receive any files of the filesystem via email.","status":"published","published":"2022-05-24T17:10:08Z","modified":"2023-01-27T05:07:49Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:43:11.926628Z"}],"nvd":[{"id":"CVE-2020-9364","description":"An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!. A directory traversal vulnerability resides in the filename field for uploaded attachments via the creativecontactform_upload parameter. An attacker could exploit this vulnerability with the \"Send me a copy\" option to receive any files of the filesystem via email.","status":"published","published":"2020-03-04T16:15:12.08Z","modified":"2026-06-17T03:27:49.157Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:54.796125Z"}]}}