CVE-2018-13123: Onefilecms

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameters, as demonstrated by ?i=etc/&f=passwd&p=raw_view for the /etc/passwd file.

Affected products

• Onefilecms Onefilecms: up to and including 2017-10-09

Published 2018-07-03. Last modified 2026-06-17.