Skip to content
OpenAdvisories
Critical · 9.8 CVE-2023-27507 EUVD-2023-31269GHSA-x7vg-mx5p-974m

MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability. If the product's file upload function and server save …

Published May 23, 2023 · Updated Jan 31, 2025 · Assigned by jpcert

Vendor: MicroEngine Product: MicroEngine Mailform

Description

MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability. If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and execute it.

Affected products

VendorProductAffectedFixed
MicroEngine MicroEngine Mailform version 1.1.0 to 1.1.8 —

References