{"id":"GHSA-wcj4-ff9m-5r7g","aliases":["CVE-2014-1836"],"title":"ImpressCMS Path Traversal to Arbitrary File Delete","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Absolute path traversal vulnerability in `htdocs/libraries/image-editor/image-edit.php` in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the `image_path` parameter in a cancel action.","severity":"medium","score":null,"published":"2022-05-17T04:12:03.000Z","modified":"2023-11-08T03:57:35.126Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"impresscms/impresscms","sources":[{"name":"OSV · GHSA-wcj4-ff9m-5r7g","url":"https://osv.dev/vulnerability/GHSA-wcj4-ff9m-5r7g"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.3.6"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["1.3.6"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2014-1836","https://github.com/ImpressCMS/impresscms/issues/914","https://github.com/pedrib/PoC/blob/master/generic/impresscms-1.3.5.txt","https://web.archive.org/web/20200228234251/http://www.securityfocus.com/bid/65279","http://community.impresscms.org/modules/smartsection/item.php?itemid=675","http://seclists.org/fulldisclosure/2014/Feb/14"],"sources":[{"name":"OSV","id":"GHSA-wcj4-ff9m-5r7g","modified":"2023-11-08T03:57:35.126843Z","url":"https://osv.dev/vulnerability/GHSA-wcj4-ff9m-5r7g"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T19:20:37.165Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[{"source":"Exploit-DB","id":"31431","url":"https://www.exploit-db.com/exploits/31431","checkedAt":"2026-10-28T07:55:38.811Z"}]}