CVE-2026-16219

Croogo CMS Admin File Manager FileManager.php isEditable path traversal

State: Published
Severity: 5.3 Medium
Published: Jul 19, 2026
Updated: Jul 20, 2026
Reserved: Jul 18, 2026

Description

A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-22 Path Traversal

Affected Products

Product	Versions
CMSCroogo	4.0.0Affected 4.0.1Affected 4.0.2Affected 4.0.3Affected 4.0.4Affected 4.0.5Affected 4.0.6Affected 4.0.7Affected

References

VDB-380042 | Croogo CMS Admin File Manager FileManager.php isEditable path traversalvdb-entrytechnical-description
VDB-380042 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-16219 | CVE Analysis and Reportthird-party-advisory
Submit #857986 | Croogo fc0648659dcb5790ba8a7429250dae492ca724ec Arbitrary File Write / Path Traversalthird-party-advisory
https://github.com/croogo/croogo/issues/1008issue-tracking
https://github.com/fa1c4/security-advisories/tree/main/Croogoexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.