CVE-2018-10057

The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write the miner configuration file to arbitrary locations on the server due to missing basedir restrictions (absolute directory traversal).

• CWE-22

• http://www.openwall.com/lists/oss-security/2018/06/03/1Mailing List, Third Party Advisory
• https://github.com/tintinweb/pub/tree/master/pocs/cve-2018-10057Exploit, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2018/06/03/1Mailing List, Third Party Advisory
• https://github.com/tintinweb/pub/tree/master/pocs/cve-2018-10057Exploit, Third Party Advisory

Published

Jun 5, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1005An elevation of privilege vulnerability exists when Microsof…
• CVE-2018-10050iScripts eSwap v2.4 has SQL injection via the "registration_…
• CVE-2018-10051iScripts SupportDesk v4.3 has XSS via the staff/inteligentse…
• CVE-2018-10052iScripts SupportDesk v4.3 has XSS via the admin/inteligentse…
• CVE-2018-10054H2 1.4.197, as used in Datomic before 0.9.5697 and other pro…8.8
• CVE-2018-10055Invalid memory access and/or a heap buffer overflow in the T…
• CVE-2018-10058The remote management interface of cgminer 4.10.0 and bfgmin…
• CVE-2018-10059Cacti before 1.1.37 has XSS because the get_current_page fun…
• CVE-2018-10060Cacti before 1.1.37 has XSS because it does not properly rej…5.4
• CVE-2018-10061Cacti before 1.1.37 has XSS because it makes certain htmlspe…5.4
• CVE-2018-10063The Convert Forms extension before 2.0.4 for Joomla! is vuln…
• CVE-2018-10066An issue was discovered in MikroTik RouterOS 6.41.4. Missing…