← Vulnerability feed

Vulnerability record · CVE-2018-10870 · published 19 July 2018

CVE-2018-10870: Redhat certification path traversal vulnerability

Redhat · Certification

redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution.

9.8 CVSS 3.0 Critical EPSS 6.1% · top 6.8% CWE-22 · Path traversalCWE-20 · Improper input validation
9.8CVSS 3.0 base score, v2 7.5
6.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/104857 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:2373 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10870 Issue TrackingMitigationVendor Advisory
http://www.securityfocus.com/bid/104857 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:2373 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10870 Issue TrackingMitigationVendor Advisory

Track CVE-2018-10870 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2018-10866Redhat certification missing authorization vulnerabilityIt was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated use…EPSS 1.0%9.1CVE-2018-10867Redhat certification vulnerabilityFiles are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file ac…EPSS 1.1%7.5CVE-2018-10863Redhat certification vulnerabilityIt was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the /var/www/rhcert/store/transfer…EPSS 1.1%7.5CVE-2018-10865Redhat certification missing authorization vulnerabilityIt was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated use…EPSS 1.0%7.5CVE-2018-10868Redhat certification uncontrolled resource consumption vulnerabilityredhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user …EPSS 1.1%7.5CVE-2018-10869Redhat certification incorrect permission assignment vulnerabilityredhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file access…EPSS 2.7%6.2CVE-2018-10864Redhat certification uncontrolled resource consumption vulnerabilityAn uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may provide …EPSS 1.2%5.3CVE-2019-3897Redhat certification vulnerabilityIt has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know its name. R…EPSS 0.91%

Source: NIST National Vulnerability Database (record CVE-2018-10870), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.