CVE-2023-26564
published 2023-07-12CVE-2023-26564: The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal. As a result, an unauthenticated attacker…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.39%
69.0th percentile
The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal. As a result, an unauthenticated attacker can list files within a directory, download any file, or upload any file to any directory accessible by the web server.
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://ej2.syncfusion.com/documentation/file-manager/file-system-provider/https://github.com/RupturaInfoSec/CVE-2023-26563-26564-26565/https://github.com/SyncfusionExamples/ej2-aspcore-file-providerhttps://ej2.syncfusion.com/documentation/file-manager/file-system-provider/https://github.com/RupturaInfoSec/CVE-2023-26563-26564-26565/https://github.com/SyncfusionExamples/ej2-aspcore-file-provider
2023-07-12
Published