CVE-2021-25020
CAOS < 4.1.9 - Admin+ Arbitrary Folder Deletion via Path Traversal
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
03 Jan 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
Affected products
Unknown · CAOS | Host Google Analytics LocallyWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →