High severity8.8OSV Advisory· Published Oct 3, 2018· Updated Jun 17, 2026

CVE-2018-17553

Description

An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated attackers to achieve remote code execution via a POST request with engine=picnik and id=../../../navigate_info.php.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Navigatecms/NavigatecmsOSV
Range: latest
Naviwebs/Navigate CMSllm-create
Range: 2.8

Patches

Vulnerability mechanics

References

github.com/NavigateCMS/Navigate-CMS/commit/2bdcb8b3c5bb23851a2115db96585f1ac8cb2d1envdPatchVendor Advisory
github.com/rapid7/metasploit-framework/pull/10704nvdExploitThird Party Advisory
www.exploit-db.com/exploits/45561/nvdExploitThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.063
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000