CVE-2018-9126: DNNArticle module path traversal exposes web.config credentials

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit code, and high EPSS make this an urgent exposure of credentials that can lead to full database compromise.

What it is

The DNNArticle module 11 for DNN (formerly DotNetNuke) accepts a CP parameter on the /GetCSS.ashx endpoint that is not properly restricted, allowing a remote attacker to traverse to and read the web.config file. Because web.config commonly holds database connection strings and other secrets, exposure of this file can hand an attacker the credentials needed to reach backend data stores.

Impact

An unauthenticated attacker gains read access to web.config, including database credentials and other configuration secrets, which can enable direct access to and compromise of the underlying database.

Attack surface

Reachable over the network through a crafted GET request to /GetCSS.ashx with a traversal value in the CP parameter. The CVSS vector shows no privileges and no user interaction required, so the endpoint is exploitable pre-authentication.

Exploitation

Public exploit code exists (Packet Storm and Exploit-DB references tagged Exploit), and EPSS is high at roughly 0.49 (98.8th percentile), though the CVE is not listed in CISA KEV.

What to do

• Apply the vendor fix or update DNNArticle to a version that validates the CP parameter; if no patch exists, remove or disable the module.
• Restrict or block access to /GetCSS.ashx at the web server or WAF until the module is patched.
• Rotate database and other credentials stored in web.config, since exposure must be assumed if the endpoint was reachable.
• Move secrets out of web.config into a protected configuration store or environment-based secret management.
• Audit web server logs for traversal attempts against GetCSS.ashx and other .ashx handlers.

Detection

• Search web server and proxy logs for requests to /GetCSS.ashx containing CP values with traversal sequences such as %2f, .., or web.config.
• Alert on any request that returns web.config or other configuration files with HTTP 200.
• Monitor for outbound database connections or authentication attempts using the application's configured credentials from unexpected sources.
• Review file access or integrity monitoring for reads of web.config by the web application process outside normal startup.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.