CVE-2011-10009

S40 CMS 0.4.2 Path Traversal

CVSS 8.7 HIGHEPSS 1.6%CWE-22

Vexday Risk Score

36Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 8.7EPSS 1.6%KEV nãoPoC —Nuclei —Metasploit simPatch —

Lifecycle

07 Apr 2011Metasploit module available

13 Aug 2025Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

S40 CMS v0.4.2 contains a path traversal vulnerability in its index.php page handler. The p parameter is not properly sanitized, allowing attackers to traverse the file system and access arbitrary files outside the web root. This can be exploited remotely without authentication by appending traversal sequences and a null byte to bypass file extension checks.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

S40 CMS · S40 CMS

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/s40_traversal.rb https://web.archive.org/web/20110613222630/http://y-osirys.com/security/exploits/id27 https://web.archive.org/web/20120531114058/http://s40.biz/https://www.exploit-db.com/exploits/17129 https://www.vulncheck.com/advisories/s40-cms-path-traversal