CVE-2018-20094: Xuxueli Xxl-Conf

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java.

Affected products

• Xuxueli Xxl-Conf: version 1.6.0 only

Published 2018-12-12. Last modified 2026-06-17.