CVE-2018-17553: Navigate CMS navigate_upload.php path traversal file upload RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution is achievable with only low-privileged authentication, public exploit code exists, and EPSS is very high, though it is not in KEV.

What it is

Navigate CMS 2.8's navigate_upload.php accepts an unrestricted file upload with a directory traversal in the id parameter, letting an authenticated attacker write a PHP file outside the intended upload directory. Because the written file is executable, this turns into remote code execution on the server.

Impact

An authenticated attacker gains remote code execution with the privileges of the web server, allowing full compromise of the CMS host and any data it can reach.

Attack surface

Reached over the network via a crafted POST request to navigate_upload.php with engine=picnik and a traversal id value. Authentication is required (PR:L) and no user interaction is needed (UI:N).

Exploitation

Public exploit code exists in Exploit-DB and a Metasploit pull request, and EPSS is very high (0.78994, 99.6th percentile), though the CVE is not listed in CISA KEV.

What to do

• Apply the vendor patch commit 2bdcb8b3c5bb23851a2115db96585f1ac8cb2d1e or upgrade past Navigate CMS 2.8.
• Restrict write permissions on the web root so uploaded files cannot be placed in executable directories.
• Disable PHP execution in upload and media directories via web server configuration.
• Enforce strict allowlists on uploaded file types and validate the id parameter against traversal sequences.
• Limit CMS upload privileges to trusted accounts and audit existing accounts with upload rights.

Detection

• Monitor POST requests to navigate_upload.php containing engine=picnik or traversal sequences such as ../ in parameters.
• Alert on new PHP files appearing in upload, media, or unexpected web-accessible directories.
• Review web server logs for requests to newly written PHP files shortly after upload activity.
• Baseline and monitor file integrity of the Navigate CMS installation for unexpected additions or modifications.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.