Vulnerability record · CVE-2015-4632 · published 18 October 2018
CVE-2015-4632: Koha ILS directory traversal in template_path parameter
Koha · Koha
Koha versions 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 contain multiple directory traversal flaws. A remote attacker can supply a ..%2f (encoded dot-dot-slash) sequence in the template_path parameter to svc/virtualshelves/search or svc/members/search to read arbitrary files on the server. This exposes configuration files, credentials, and other sensitive data on the library system.
Description
Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path parameter to (1) svc/virtualshelves/search or (2) svc/members/search.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated remote file read with public exploit code and high EPSS, though no KEV listing and no integrity or availability impact.
What it is
Koha versions 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 contain multiple directory traversal flaws. A remote attacker can supply a ..%2f (encoded dot-dot-slash) sequence in the template_path parameter to svc/virtualshelves/search or svc/members/search to read arbitrary files on the server. This exposes configuration files, credentials, and other sensitive data on the library system.
Impact
An unauthenticated remote attacker gains read access to arbitrary files on the Koha host, which can leak database credentials, configuration, and other sensitive data. There is no integrity or availability impact per the CVSS vector.
Attack surface
Reachable over the network via HTTP requests to the svc/virtualshelves/search or svc/members/search endpoints with a crafted template_path parameter. The CVSS vector shows no privileges required and no user interaction, so the endpoints are reachable without authentication.
Exploitation
Not listed in CISA KEV, but public exploit code exists (Exploit-DB 37388 and a Packet Storm advisory), and EPSS is 0.51829 (98.9th percentile), indicating elevated likelihood of exploitation.
What to do
- Upgrade Koha to 3.14.16, 3.16.12, 3.18.08, 3.20.1 or later as applicable.
- Restrict network access to the svc/ endpoints to trusted networks or authenticated users where feasible.
- Run the Koha web service with least privilege and limit filesystem read permissions for the web user.
- Review and remove any unnecessary exposure of the svc/virtualshelves/search and svc/members/search endpoints.
- Monitor vendor release notes and bug 14408 for the official patch.
Detection
- Search web logs for requests to svc/virtualshelves/search or svc/members/search containing ..%2f or ../ sequences in template_path.
- Alert on HTTP responses from those endpoints returning file contents or unexpected file paths.
- Monitor for anomalous reads of sensitive files (e.g., koha-conf.xml, /etc/passwd) by the web server process.
- Correlate outbound or internal requests to these endpoints with unusual client IPs or user agents.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-4632 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-4632), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
