CVE-2018-11141: Quest KACE System Management Appliance

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to write and delete files respectively via Directory Traversal. Files can be at any location where the 'www' user has write permissions.

Affected products

• Quest KACE System Management Appliance: version 8.0.318 only

Published 2018-05-31. Last modified 2026-06-17.