CVE-2018-16836: Rubedo CMS theme component directory traversal allows unauthenticated file read and execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit code available, and very high EPSS probability make this an urgent exposure for any internet-facing Rubedo 3.4.0 or earlier instance.

What it is

Rubedo through 3.4.0 contains a directory traversal flaw in its theme component. An unauthenticated attacker can supply traversal sequences in a theme URI to reach files outside the service root, as shown by a /theme/default/img/%2e%2e/..//etc/passwd request. The flaw matters because it exposes arbitrary files and, per the description, can also lead to execution of arbitrary files.

Impact

An attacker can read arbitrary files outside the web root, exposing configuration, credentials and other sensitive data. The description also states arbitrary files can be executed, which could allow code execution depending on server configuration.

Attack surface

Reachable over the network through the theme component's URI path; the CVSS vector shows no privileges and no user interaction required. No authentication is needed to send the crafted traversal request.

Exploitation

Public exploit code is referenced (Exploit-DB 45385 and a GitHub PoC), and EPSS is 0.61437 (99.1st percentile), indicating high likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild activity is recorded here.

What to do

• Upgrade Rubedo past 3.4.0 to a fixed release; if no fixed version is available, treat the theme component as untrusted and restrict access to it.
• Block or normalize traversal sequences (../, %2e%2e, encoded variants) at the web server or reverse proxy before requests reach Rubedo.
• Run the web service with least privilege and a restricted filesystem view so traversal cannot reach sensitive paths such as /etc/passwd.
• Disable execution of files served from theme or static directories to prevent the described arbitrary file execution.
• Monitor vendor advisories for a patched release and apply it as soon as it is published.

Detection

• Search web access logs for theme requests containing traversal patterns such as ../, %2e%2e, ..//, or paths targeting /etc/passwd and similar system files.
• Alert on HTTP requests to /theme/ paths with encoded dot sequences or unusual file extensions.
• Monitor for reads of sensitive files by the web service user outside the application root using file integrity or audit tooling.
• Correlate repeated traversal attempts from the same source IP with other scanning or exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.