Medium severity6.5NVD Advisory· Published Mar 21, 2026· Updated Jun 17, 2026

CVE-2019-25574

Description

Green CMS 2.x contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files and directories by injecting directory traversal sequences. Attackers can manipulate the theme_name parameter in the themeexporthandle action or supply base64-encoded file paths to the downfile action to retrieve sensitive files outside intended directories.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Greencms/Greencmsv53 versions
2.0+ 2 more
- (no CPE)range: 2.0
- cpe:2.3:a:njtech:greencms:*:*:*:*:*:*:*:*range: >=2.1.0612,<=2.3.0603
- (no CPE)range: 2.x

Patches

Vulnerability mechanics

References

www.exploit-db.com/exploits/46245nvdExploitThird Party AdvisoryVDB Entry
www.vulncheck.com/advisories/green-cms-2-x-path-traversal-arbitrary-file-downloadnvdThird Party Advisory
www.greencms.netnvdBroken Link
codeload.github.com/GreenCMS/GreenCMS/zip/betanvdProduct

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000