CVE-2018-5755 in OX AppSuite
Summary
by MITRE
Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/25/2025
The CVE-2018-5755 vulnerability represents a critical absolute path traversal flaw within the readerengine component of Open-Xchange OX App Suite, a widely deployed enterprise collaboration platform. This vulnerability affects multiple version branches including 7.6.3-rev2 and earlier, 7.8.1-rev3 and earlier, 7.8.2-rev4 and earlier, 7.8.3-rev4 and earlier, and 7.8.4-rev3 and earlier, creating a substantial attack surface across the platform's deployment ecosystem. The vulnerability specifically manifests when processing spreadsheet formulas that contain full pathnames, enabling malicious actors to exploit the system's file handling mechanisms to access arbitrary files on the underlying filesystem.
The technical exploitation of this vulnerability stems from inadequate input validation and sanitization within the readerengine component's formula processing logic. When a spreadsheet formula contains an absolute path reference, the system fails to properly validate or sanitize this input before attempting to resolve or process the file reference. This allows attackers to craft malicious formulas that traverse the filesystem hierarchy and access sensitive files that should remain protected, including configuration files, database credentials, application source code, and other critical system resources. The vulnerability operates at the core of the application's file processing pipeline, where user-supplied data is directly translated into filesystem operations without proper security boundaries.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with the capability to escalate privileges and potentially compromise the entire application environment. Remote attackers can leverage this vulnerability to access sensitive data that may include user credentials, system configuration details, and business-critical information stored in the application's file system. The implications are particularly severe for enterprise environments where OX App Suite serves as a central collaboration platform, as successful exploitation could lead to complete system compromise, data exfiltration, and unauthorized access to corporate resources. Organizations using affected versions face significant risk of unauthorized data access and potential system infiltration.
Mitigation strategies for this vulnerability require immediate patching of affected systems to the patched versions mentioned in the CVE details, specifically versions 7.6.3-rev3, 7.8.2-rev4, 7.8.3-rev5, and 7.8.4-rev4 respectively. Organizations should also implement network-level restrictions to limit access to the application's spreadsheet processing capabilities and consider implementing input validation controls at the application level to prevent absolute path traversal attempts. Security monitoring should be enhanced to detect unusual file access patterns and formula processing activities that may indicate exploitation attempts. This vulnerability aligns with CWE-22, which describes path traversal flaws, and represents a clear violation of the principle of least privilege in application security design, as demonstrated by ATT&CK technique T1074 for data staging and T1566 for initial access through malicious files.