CVE-2018-17125: Chshcms Cscms

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

CScms 4.1 allows arbitrary directory deletion via a dir=..\\ substring to plugins\sys\admin\Plugins.php.

Affected products

• Chshcms Cscms: version 4.1 only

Published 2018-09-17. Last modified 2026-06-17.