CVE-2019-15952

Vulnerability

Overview CVE-2019-15952 is a path traversal vulnerability in Total.js CMS version 12.0.0. The issue stems from insufficient input validation of the template parameter in the page creation API. An authenticated user with the Pages privilege can inject ../ sequences to include .html files located outside the intended directory [1][3].

Exploitation

To exploit the vulnerability, an attacker sends a specially crafted POST request to the admin pages endpoint, modifying the template JSON parameter to include a path traversal payload (e.g., ../../../../../../../../../../../../var/www/html/test_rce). The backend automatically appends the .html extension, so the attacker must omit it [4]. If the included .html file contains a template directive, that directive is executed server-side.

Impact

By controlling the content of an externally located .html file, an attacker can inject a malicious template directive, leading to remote code execution on the server. This gives the attacker the ability to execute arbitrary commands, potentially compromising the entire CMS installation [1][4].

Mitigation

No official patch was released by the vendor at the time of disclosure. Administrators should restrict the Pages privilege to trusted users only and ensure that uploaded or included .html files cannot be controlled by untrusted parties. Consider using a web application firewall to block path traversal attempts [1][3].