CVE-2018-19181: Yunucms

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action=remove key parameter, as demonstrated by using directory traversal to delete the install.lock file.

Affected products

• Yunucms Yunucms: version 1.1.5 only

Published 2018-11-11. Last modified 2026-06-17.