CVE-2018-18950: Kindeditor

High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days.

KindEditor through 4.1.11 has a path traversal vulnerability in php/upload_json.php. Anyone can browse a file or directory in the kindeditor/attached/ folder via the path parameter without authentication.

Affected products

• Kindeditor Kindeditor: up to and including 4.1.11

Published 2018-11-05. Last modified 2026-06-17.