CVE-2018-8770: Cobub Razor test scripts leak physical server paths

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityThe flaw only leaks path information (CVSS 5.3, low confidentiality impact), but public exploit code and a high EPSS score make opportunistic scanning likely.

What it is

Cobub Razor 0.8.0 exposes physical filesystem paths through a set of test scripts under tests/, including generate.php, several controllers/*Test.php files, fixtures, libs/ipTest.php and models/commonDbfix.php. The flaw is a CWE-200 information exposure that reveals server directory layout, which aids reconnaissance for follow-on attacks. The record does not state which specific versions beyond 0.8.0 are affected.

Impact

An attacker gains low-value information: the absolute filesystem paths of the application on the server. That alone does not grant code execution or data access, but it helps map the deployment and plan further exploitation.

Attack surface

Reachable over the network via HTTP requests to the listed test scripts; the CVSS vector shows no privileges and no user interaction required. The description does not state whether the tests/ directory is exposed by default or only in certain deployments.

Exploitation

Public exploit code exists (Exploit-DB 44495 and a GitHub advisory, both tagged Exploit), and EPSS is 0.59208 (99th percentile), indicating elevated likelihood of exploitation attempts. It is not listed in CISA KEV, so no confirmed in-the-wild campaign is documented in this record.

What to do

• Upgrade or patch Cobub Razor to a release that removes or fixes the tests/ scripts; the record does not name a fixed version, so confirm with the vendor.
• If no patch is available, block or remove the tests/ directory and the listed scripts from the web root.
• Restrict access to test and fixture files via web server rules (deny direct HTTP access to tests/, fixtures/, libs/ and models/ paths).
• Disable detailed error output and path disclosure in production PHP configuration.
• Monitor for requests to the listed test script paths and treat them as hostile reconnaissance.

Detection

• Search web access logs for requests to /tests/, generate.php, controllers/getConfigTest.php, getUpdateTest.php, postclientdataTest.php, posterrorTest.php, posteventTest.php, posttagTest.php, postusinglogTest.php, fixtures/Controller_fixt.php, Controller_fixt2.php, view_fixt2.php, libs/ipTest.php and models/commonDbfix.php.
• Alert on HTTP responses from those paths that contain absolute filesystem paths (e.g., /var/www, C:\ paths) or PHP warning text.
• Baseline normal traffic to the application and flag first-time or scanner-style requests to test endpoints.
• Correlate repeated hits on these paths from a single source with other reconnaissance activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.