CVE-2018-11413: Bearadmin Project Bearadmin

Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days.

An issue was discovered in BearAdmin 0.5. Remote attackers can download arbitrary files via /admin/databack/download.html?name= directory traversal sequences, as demonstrated by name=../application/database.php to read the MySQL credentials in the configuration.

Affected products

• Bearadmin Project Bearadmin: version 0.5 only

Published 2018-05-24. Last modified 2026-06-17.