CVE-2008-7178: Xoops Uploader

High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days.

Directory traversal vulnerability in Uploader module 1.1 for XOOPS allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a downloadfile action to index.php.

Affected products

• Xoops Uploader: version 1.1 only

Published 2009-09-08. Last modified 2026-06-16.