CVE-2019-25582
i-doit CMDB 1.12 Arbitrary File Download via file_manager Parameter
- State
- Published
- Severity
- 7.1 High
- Published
- Mar 21, 2026
- Updated
- Mar 24, 2026
- Reserved
- Mar 21, 2026
Description
i-doit CMDB 1.12 contains an arbitrary file download vulnerability that allows authenticated attackers to download sensitive files by manipulating the file parameter in index.php. Attackers can send GET requests to index.php with file_manager=image and supply arbitrary file paths like src/config.inc.php to retrieve configuration files and sensitive system data.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
doit CMDBI-Doit |
|
References
- ExploitDB-46133exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: i-doit CMDB 1.12 Arbitrary File Download via file_manager Parameterthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.