CVE-2018-11137: Quest KACE System Management Appliance

Medium severity, CVSS 6.5. EPSS: 6.4% chance of exploitation in the next 30 days.

The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary files with 'www' privileges via Directory Traversal. No administrator privileges are needed to execute this script.

Affected products

• Quest KACE System Management Appliance: version 8.0.318 only

Published 2018-05-31. Last modified 2026-06-17.