Skip to content
Sign in
5.1 Medium

CVE-2026-4222 A vulnerability was determined in SSCMS up to 7.4.0

Description

A vulnerability was determined in SSCMS up to 7.4.0. This vulnerability affects the function PathUtils.RemoveParentPath of the file /api/admin/plugins/install/actions/download. This manipulation of the argument path causes path traversal. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products and versions

Product Affected versions Fixed in
SSCMS 7.4.0 No fix stated
SSCMS 7.3 No fix stated
SSCMS 7.2 No fix stated
SSCMS 7.1 No fix stated
SSCMS 7.0 No fix stated

Other CVEs of SSCMS

The 3 CVEs of SSCMS →
CVE-2026-4542 A vulnerability has been found in SSCMS 4.7.0 5.3 Medium CVE-2026-4234 A security flaw has been discovered in SSCMS 7.4.0 5.3 Medium
Track this CVE