CVE-2018-18323: CentOS Web Panel file_editor directory traversal local file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw is remotely reachable with no authentication or interaction per the CVSS vector, has public exploit code, and carries a very high EPSS score, though it is not in KEV.

What it is

CentOS Web Panel 0.9.8.480 exposes an admin file_editor module that accepts a file parameter containing directory traversal sequences, allowing local file inclusion. An attacker can read arbitrary files on the server through the web interface. The flaw is a path traversal (CWE-22) with a CVSS 3.0 base score of 7.5 (HIGH).

Impact

An attacker gains read access to files on the host, which can expose credentials, configuration and other sensitive data. The CVSS vector shows high confidentiality impact with no integrity or availability impact.

Attack surface

Reached over the network via an HTTP request to admin/index.php with module=file_editor and a crafted file parameter. The CVSS vector indicates no privileges and no user interaction are required, though the endpoint is under the admin path.

Exploitation

Public exploit code is referenced on Exploit-DB and 0day.today, and EPSS is 0.70736 (99.365th percentile), indicating high predicted exploitation activity. The CVE is not listed in CISA KEV.

What to do

• Upgrade CentOS Web Panel to a version later than 0.9.8.480 if one is available; the record does not name a fixed version.
• Restrict access to the admin interface and admin/index.php to trusted IP addresses.
• Validate and canonicalize the file parameter, rejecting traversal sequences such as ../ before file access.
• Run the panel with least privilege and isolate it so file reads cannot reach sensitive system files.
• Monitor vendor advisories for a confirmed patch since the record does not specify one.

Detection

• Search web logs for requests to admin/index.php with module=file_editor and file parameters containing ../ or encoded traversal.
• Alert on file_editor requests returning content from paths outside the intended editor directory.
• Review access logs for repeated or automated traversal attempts against the admin endpoint.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.