Low severity2.7OSV Advisory· Published Dec 23, 2018· Updated Jun 17, 2026
CVE-2018-20405
CVE-2018-20405
Description
BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error. NOTE: This has been disputed with the following reasoning: "The issue reported requires full developer level access to the content management system where cross site scripting is not an issue -- you already have full control of the CMS including running arbitrary PHP.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: 4.0beta2, 4.2, 4.2.10, …
- cpe:2.3:a:bigtreecms:bigtree:4.3:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
1- github.com/bigtreecms/BigTree-CMS/issues/354nvdExploitIssue TrackingThird Party Advisory
News mentions
0No linked articles in our index yet.