CVE-2016-20023: Cksource Ckfinder

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.

Affected products

• Cksource Ckfinder: before 2.5.0.1 (fixed in 2.5.0.1)

Published 2025-12-05. Last modified 2026-06-17.