CVE-2018-25308
BuddyPress Xprofile Custom Fields Type 2.6.3 Arbitrary File Deletion
- State
- Published
- Severity
- 8.7 High
- Published
- Apr 29, 2026
- Updated
- Oct 29, 2026
- Reserved
- Apr 29, 2026
Description
BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field_hiddenfile and field_deleteimg parameters during profile editing to unlink files from the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
Buddypress Xprofile Custom Fields Typedonmik |
|
References
- ExploitDB-44432exploit
- Official Product Homepageproduct
- VulnCheck Advisory: BuddyPress Xprofile Custom Fields Type 2.6.3 Remote Code Executionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.