CVE-2019-14767: Dimo-CRM Yellowbox CRM

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (document=../) allows an unauthenticated user to download arbitrary files from the server.

Affected products

• Dimo-CRM Yellowbox CRM: before 6.3.4 (fixed in 6.3.4)

Published 2020-01-21. Last modified 2026-06-17.