High severity8.8NVD Advisory· Published Jan 1, 2021· Updated Jun 17, 2026

CVE-2018-25002

Description

uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles validation, aka SA-CONTRIB-2018-024. NOTE: This project is not covered by Drupal's security advisory policy.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Sunhater/Kcfinder
cpe:2.3:a:sunhater:kcfinder:*:*:*:*:*:drupal:*:*
Range: <=2018-06-01
Drupal/KCFinder integration projectdescription
Drupal/kcfinderllm-create
Range: <=2018-06-01

Patches

Vulnerability mechanics

References

www.drupal.org/project/kcfinder/issues/1768718nvdThird Party Advisory
www.drupal.org/project/kcfinder/issues/1768720nvdThird Party Advisory
www.drupal.org/sa-contrib-2018-024nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000