CVEs-PoC/2018/CVE-2018-11248.md

CVE-2018-11248

Description

util/FileDownloadUtils.java in FileDownloader 1.7.3 does not check an attachment's name. If an attacker places "../" in the file name, the file can be stored in an unintended directory because of Directory Traversal.

POC

Reference

No PoCs from references.

Github

• https://github.com/A-TPL-Bench/LibHunter
• https://github.com/Anonymous-Phunter/PHunter
• https://github.com/CGCL-codes/LibHunter
• https://github.com/CGCL-codes/PHunter
• https://github.com/LibHunter/LibHunter