CVE-2008-1606

Multiple directory traversal vulnerabilities in Elastic Path (EP) 4.1 and 4.1.1 allow remote attackers to (1) download arbitrary files via a .. (dot dot) in the file parameter to manager/getImportFileRedirect.jsp, (2) upload arbitrary files via a "..\" (dot dot backslash) in the file parameter to importData.jsp, and (3) list directory contents via a .. (dot dot) in the dir parameter to manager/fileManager.jsp.

• CWE-22

• http://developer.elasticpath.com/entry%21default.jspa?categoryID=4&externalID=1334
• http://secunia.com/advisories/29496Patch, Vendor Advisory
• http://weblog.nomejortu.com/?p=37
• http://www.mwrinfosecurity.com/publications/mwri_elastic-path-arbitrary-file-system-access_2008-02-22.pdfExploit
• http://www.securityfocus.com/bid/28352
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41356
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41364
• http://developer.elasticpath.com/entry%21default.jspa?categoryID=4&externalID=1334
• http://secunia.com/advisories/29496Patch, Vendor Advisory
• http://weblog.nomejortu.com/?p=37
• http://www.mwrinfosecurity.com/publications/mwri_elastic-path-arbitrary-file-system-access_2008-02-22.pdfExploit
• http://www.securityfocus.com/bid/28352
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41356
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41364

Published

Apr 1, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-1600The lsmcode program on IBM AIX 5.2, 5.3, and 6.1 does not pr…
• CVE-2008-1601Stack-based buffer overflow in the reboot program on IBM AIX…
• CVE-2008-1602Stack-based buffer overflow in Orbit downloader 2.6.3 and 2.…
• CVE-2008-1603Cross-site scripting (XSS) vulnerability in GNB DesignForm b…
• CVE-2008-1604Cross-site scripting (XSS) vulnerability in PerlMailer befor…
• CVE-2008-1605The (1) ltmmCaptureCtrl Class, (2) ltmmConvertCtrl Class, an…
• CVE-2008-1607SQL injection vulnerability in haberoku.php in Serbay Arslan…
• CVE-2008-1608SQL injection vulnerability in postview.php in Clever Copy 3…
• CVE-2008-1609Multiple PHP remote file inclusion vulnerabilities in just a…
• CVE-2008-1610Stack-based buffer overflow in TallSoft Quick TFTP Server Pr…
• CVE-2008-1611Stack-based buffer overflow in TFTP Server SP 1.4 for Window…
• CVE-2008-1612The arrayShrink function (lib/Array.c) in Squid 2.6.STABLE17…