CVE-2018-9205: Drupal avatar_uploader view.php path traversal exposes files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote file read with public exploit code and very high EPSS, though no KEV listing or confirmed in-the-wild use is present.

What it is

The avatar_uploader module for Drupal (v7.x-1.0-beta8) contains a path traversal flaw in view.php, which neither verifies the user nor sanitizes the file path. An unauthenticated remote attacker can supply a crafted path to read files outside the intended directory. This matters because it exposes arbitrary files on the server without any login.

Impact

An attacker gains read access to files on the web server, potentially including configuration files, credentials, or other sensitive data. There is no write or code execution impact per the CVSS vector, which is confidentiality-only.

Attack surface

Reachable over the network through the view.php endpoint of the avatar_uploader module; the CVSS vector shows no privileges required and no user interaction. No authentication is needed to send the malicious path.

Exploitation

Public exploit code is referenced (Exploit-DB 44501 and a VAPID Labs advisory), and EPSS is 0.55079 (98.98th percentile), indicating a high likelihood of exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild use is documented in this record.

What to do

• Update the avatar_uploader module to a fixed release; check the Drupal project page and issue 2957966 for the patched version.
• If no fixed version is available, disable or uninstall the avatar_uploader module.
• Restrict access to view.php and the module's endpoints at the web server or WAF level.
• Run the Drupal site with least-privilege file permissions so traversal reads expose as little as possible.
• Monitor Drupal security advisories for this module for further updates.

Detection

• Search web server logs for requests to avatar_uploader view.php containing traversal sequences such as ../ or encoded variants.
• Alert on unusual file paths or absolute paths passed as parameters to view.php.
• Review outbound or error responses for file contents that should not be served.
• Correlate requests to the module with unexpected reads of configuration or credential files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.