CVE-2026-117127 in GleezCMS
Summary
by MITRE • 11/02/2026
Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a remote attacker to obtain sensitive information via the action_serve function in media.php
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The identified security flaw represents a classic directory traversal vulnerability within the Gleez CMS, specifically affecting version 1.2.0. This type of weakness is formally categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core technical issue resides in the action_serve function located within the media.php script component of the application. In secure software design, functions that handle file serving must strictly validate and sanitize user-supplied input to ensure it references files only within an intended, restricted directory structure. However, in this instance, the implementation fails to adequately process path separators or normalize filenames provided by the client request. This lack of rigorous validation allows a remote attacker to manipulate the requested resource identifier using standard traversal sequences such as dot-dot-slash (../). By injecting these characters into the input parameters, an adversary can break out of the designated media directory and traverse up the server's file system hierarchy.
The operational impact of this vulnerability is significant for any organization deploying this specific version of Gleez CMS without mitigation. Because the flaw permits arbitrary file reading from the underlying operating system, a remote attacker with no prior authentication or access privileges can retrieve sensitive information stored on the web server. This includes configuration files that may contain database credentials, API keys, and other secrets necessary for application operation. Furthermore, attackers could potentially read source code of other applications hosted on the same server if directory permissions allow it, leading to a broader compromise of the infrastructure. The ability to exfiltrate such data facilitates further attacks, including credential stuffing or targeted phishing campaigns based on harvested organizational details. This aligns with the ATT&CK technique T1083: File and Directory Discovery, where adversaries explore local file systems to gather intelligence for subsequent exploitation phases.
To mitigate this vulnerability, immediate remediation is required by updating the Gleez CMS installation to a patched version that addresses these input validation flaws if available from the vendor. In cases where an update is not immediately feasible or possible due to legacy constraints, defense-in-depth strategies must be employed at the infrastructure level. Web Application Firewalls (WAFs) can be configured with rulesets specifically designed to detect and block directory traversal patterns in HTTP requests targeting file-serving endpoints. Additionally, server administrators should ensure that the web service account operates under a restricted user context with minimal permissions, limiting the scope of files accessible even if an attacker successfully exploits the path manipulation flaw. Implementing strict input validation on the application side remains the primary corrective action, requiring developers to canonicalize paths and verify they remain within the expected base directory before processing any file serve requests.