CVE-2023-27179: GDidees CMS arbitrary file download via filename parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable arbitrary file read with a high EPSS score and public exploit detail, though no KEV listing or confirmed in-the-wild exploitation.

What it is

GDidees CMS v3.9.1 and lower contains an arbitrary file download vulnerability reachable through the filename parameter at /_admin/imgdownload.php. The flaw allows unauthenticated remote retrieval of files from the server, exposing configuration, credentials or other sensitive data. Note the record's CWE (CWE-434 Unrestricted file upload) does not match the described file download behavior, and no fixed version is stated.

Impact

An attacker can read arbitrary files on the host, potentially obtaining credentials, configuration or source code that enables further compromise. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reached over the network via HTTP requests to /_admin/imgdownload.php with a crafted filename parameter. The CVSS vector indicates no authentication and no user interaction are required, though the path sits under an admin directory.

Exploitation

Not listed in CISA KEV and no ransomware use documented. EPSS is high (0.60793, 99.1st percentile) and public references include a Packet Storm advisory and a third-party gist, indicating public technical detail is available.

What to do

• Upgrade GDidees CMS to a version above 3.9.1 if the vendor provides one; the record does not name a fixed release, so confirm with the vendor.
• If no fix is available, restrict or block access to /_admin/imgdownload.php at the web server or WAF.
• Require authentication and authorization for admin endpoints and validate the filename parameter against a strict allowlist.
• Run the CMS with least privilege and store no sensitive files in web-accessible paths.
• Monitor vendor and advisory channels for a patched release.

Detection

• Review web logs for requests to /_admin/imgdownload.php with filename parameters containing traversal sequences such as ../ or encoded variants.
• Alert on downloads of sensitive paths (e.g., configuration files, /etc/passwd) from the web server process.
• Baseline normal imgdownload.php usage and flag anomalous or high-volume file retrieval from that endpoint.
• Check for outbound or local file reads by the web user account outside expected image directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.