MetInfo CMS: Unauthenticated path traversal allowing arbitrary file read
Summary
MetInfo CMS versions 6.0.0 up to 6.1.0 contain a path traversal flaw in /include/thumb.php, reached through the dir parameter. An unauthenticated remote attacker can read arbitrary files on the server, for example configuration files with database credentials, by sending crafted requests with backslash or dot-slash sequences that bypass the filter. A public Nuclei template exists, and the CVE record reports exploitation evidence first observed on 2023-10-14.
Affected
- MetInfo CMS 6.0.0 to before 6.1.1
Fixed in
- MetInfo CMS 6.1.1 (confirm the fixed build in the vendor release notes)
Workaround
Unknown. No vendor workaround is documented in the sources.
Exploitation
- Public proof of concept: a Nuclei template and a Seebug write-up are publicly available.
- The CVE record reports exploitation evidence first observed by the Shadowserver Foundation on 2023-10-14.
- CISA SSVC assessment: exploitation 'poc', automatable 'no'.
- Sources conflict on whether the CVE is listed in the CISA KEV catalogue; this could not be verified.
Our recommendation
- Inventory all MetInfo installations, including those on client websites.
- Upgrade affected installations to 6.1.1 or later, or migrate to a supported version.
- Until patched, restrict access to /include/thumb.php at the web server or WAF level.
- Review web logs for requests to thumb.php and rotate database credentials if exposure is suspected.
- Verify the KEV status against the CISA catalogue before deciding on urgency.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: MetInfo CMS 6.1.1 unauthenticated path traversal www.vulncheck.com
- Nuclei template metinfo-lfi.yaml (ProjectDiscovery) github.com
- Seebug paper 676 (archived): MetInfo arbitrary file read fix and bypass web.archive.org
- MetInfo vendor website www.metinfo.cn
- VulDB entry 425260 vuldb.com
- HOL Guard: CVE-2018-25439 MetInfo CMS 6.1.1 path traversal hol.org
- Exploit-Intel: CVE-2018-25439 exploit-intel.com
- Strix: CVE-2018-25439 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:53.
Original description (NVD)
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
NVD references (4)
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/metinfo-lfi.yaml
- https://web.archive.org/web/20190916061234/https://paper.seebug.org/676/
- https://www.metinfo.cn/
- https://www.vulncheck.com/advisories/metinfo-cms-6.1.1-unauthenticated-path-traversal-via-thumb-php-dir-param…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.