CVE-2014-1222: Vtiger CRM

Medium severity, CVSS 4.0. EPSS: 8.8% chance of exploitation in the next 30 days.

Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter in a download action. NOTE: it is likely that this issue is actually in the KCFinder third-party component, and it affects additional products besides Vtiger CRM.

Affected products

• Vtiger Vtiger CRM: up to and including 6.0.0

Published 2014-08-12. Last modified 2026-06-17.