CVE-2022-28527
Description
dhcms v20170919 was discovered to contain an arbitrary folder deletion vulnerability via /admin.php?r=admin/AdminBackup/del.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- dhcms/dhcmsdescription
- Range: = v20170919
Patches
Vulnerability mechanics
Root cause
"Insufficient filtering of path traversal sequences in the folder deletion function allows arbitrary directory deletion."
Attack vector
An attacker must first authenticate to the admin backend [ref_id=1]. The attacker then sends a POST request to `/admin.php?r=admin/AdminBackup/del` with a `data` parameter containing `../` path traversal sequences (e.g., `data=../111`) [ref_id=1]. Because the code only blocks `.` or `..` but not `../` or `..\`, the traversal succeeds and deletes an arbitrary folder [ref_id=1].
Affected code
The vulnerability resides in `/framework/ext/Util.php` [ref_id=1]. The code does not filter `../` or `..\` sequences, only filtering `.` or `..`, which allows directory traversal in the delete operation [ref_id=1]. The vulnerable endpoint is `/admin.php?r=admin/AdminBackup/del` [ref_id=1].
What the fix does
No patch is provided in the bundle. The researcher recommends filtering `../` or `..\` sequences in the input handling code within `/framework/ext/Util.php` [ref_id=1]. The fix should reject or sanitize path traversal patterns before passing the value to the file deletion routine.
Preconditions
- authAttacker must be authenticated to the admin backend
- networkAttacker must be able to send POST requests to /admin.php?r=admin/AdminBackup/del
- inputThe data parameter must contain ../ or ..\ path traversal sequences
Reproduction
1. Log in to the backend. 2. Send a POST request to `/admin.php?r=admin/AdminBackup/del` with `Content-Type: application/x-www-form-urlencoded` and body `data=../111` (or similar traversal payload). The server responds indicating the folder was deleted successfully [ref_id=1].
Generated on May 28, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- github.com/ShaoGongBra/dhcms/issues/5mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.