CVE-2022-2926
Download Manager < 3.2.55 - Admin+ Arbitrary File/Folder Access via Path Traversal
- State
- Published
- Severity
- 4.9 Medium
- Published
- Sep 26, 2022
- Updated
- May 21, 2025
- Reserved
- Aug 22, 2022
Description
The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
Download ManagerUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.