CVE-2015-1398

Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism. NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files.

• CWE-22

• http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/Exploit
• http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerabilityPatch, Vendor Advisory
• http://www.securitytracker.com/id/1032194
• http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/Exploit
• http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerabilityPatch, Vendor Advisory
• http://www.securitytracker.com/id/1032194

Published

Apr 29, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-1392Multiple SQL injection vulnerabilities in Aruba Networks Cle…
• CVE-2015-1393SQL injection vulnerability in the Photo Gallery plugin befo…
• CVE-2015-1394Multiple cross-site scripting (XSS) vulnerabilities in the P…5.4
• CVE-2015-1395Directory traversal vulnerability in GNU patch versions whic…
• CVE-2015-1396A Directory Traversal vulnerability exists in the GNU patch …7.5
• CVE-2015-1397SQL injection vulnerability in the getCsvFile function in th…
• CVE-2015-1399PHP remote file inclusion vulnerability in the fetchView fun…
• CVE-2015-1400SQL injection vulnerability in search.php in NPDS Revolution…
• CVE-2015-1401Improper Authentication vulnerability in the "LDAP / SSO Aut…
• CVE-2015-1402Cross-site scripting (XSS) vulnerability in the Content Rati…
• CVE-2015-1403SQL injection vulnerability in the Content Rating extension …
• CVE-2015-1404Cross-site scripting (XSS) vulnerability in the Content Rati…