CVE-2008-6658: Simple Machines Forum

Medium severity, CVSS 4.0. EPSS: 2% chance of exploitation in the next 30 days.

Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. (dot dot) in the package parameter during an install2 action, as demonstrated by a predictable package filename in attachments/ that was uploaded through a post2 action to index.php.

Affected products

• Simple Machines Simple Machines Forum: version 1.0.5 only; version 1.0.6 only; version 1.0.7 only; version 1.0.11 only; version 1.0.12 only; version 1.1.1 only; …

Published 2009-04-07. Last modified 2026-06-16.