← Vulnerability feed

Vulnerability record · CVE-2018-11141 · published 31 May 2018

CVE-2018-11141: Quest kace system management appliance path traversal vulnerability

Quest · Kace System Management Appliance

The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to write and delete files respectively via Directory Traversal. Files can be at any location where the 'www' user has write permissions.

9.8 CVSS 3.0 Critical EPSS 2.0% · top 19.8% CWE-22 · Path traversal
9.8CVSS 3.0 base score, v2 7.5
2.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to write and delete files respectively via Directory Traversal. Files can be at any location where the 'www' user has write permissions.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities ExploitTechnical DescriptionThird Party Advisory
https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities ExploitTechnical DescriptionThird Party Advisory

Track CVE-2018-11141 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-11138Quest KACE System Management Appliance unauthenticated OS command injectionThe download_agent_installer.php script in Quest KACE System Management Appliance 8.0.318 is reachable by anonymous users and passes input to the ope…KEVEPSS 92%analysed9.8CVE-2018-11136Quest kace system management appliance sql injection vulnerabilityThe 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sani…EPSS 1.4%9.8CVE-2018-11140Quest kace system management appliance sql injection vulnerabilityThe 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, lead…EPSS 1.4%8.8CVE-2018-11132Quest kace system management appliance os command injection vulnerabilityIn order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs da…EPSS 18%8.8CVE-2018-11134Quest kace system management appliance weak password recovery vulnerabilityIn order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed tha…EPSS 3.0%8.8CVE-2018-11135Quest kace system management appliance prototype pollution vulnerabilityThe script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object inject…EPSS 2.1%8.8CVE-2018-11139Quest kace system management appliance os command injection vulnerabilityThe '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and…EPSS 43%6.5CVE-2018-11137Quest kace system management appliance path traversal vulnerabilityThe 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read …EPSS 6.5%

Source: NIST National Vulnerability Database (record CVE-2018-11141), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.