CScms 4.1 allows arbitrary directory deletion via a dir=..\\ substring to plugins\sys\admin\Plugins.php.

Published Sep 17, 2018 · Updated Aug 5, 2024 · Assigned by mitre