CVE-2018-11342

A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the dest_folder parameter.

• CWE-22

• http://seclists.org/fulldisclosure/2018/May/2Mailing List, Third Party Advisory
• https://github.com/mefulton/asustorexploitExploit, Third Party Advisory
• https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitationExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2018/May/2Mailing List, Third Party Advisory
• https://github.com/mefulton/asustorexploitExploit, Third Party Advisory
• https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitationExploit, Third Party Advisory

Published

May 22, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-11335GVToken Genesis Vision (GVT) is a smart contract running on …
• CVE-2018-11338Intuit Lacerte 2017 for Windows in a client/server environme…
• CVE-2018-11339An XSS issue was discovered in Frappe ERPNext v11.x.x-develo…
• CVE-2018-1134An issue was discovered in Moodle 3.x. Students who submitte…
• CVE-2018-11340An unrestricted file upload vulnerability in importuser.cgi …
• CVE-2018-11341Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM…
• CVE-2018-11343A persistent cross site scripting vulnerability in playlistm…
• CVE-2018-11344A path traversal vulnerability in download.cgi in ASUSTOR AS…
• CVE-2018-11345An unrestricted file upload vulnerability in upload.cgi in A…
• CVE-2018-11346An insecure direct object reference vulnerability in downloa…
• CVE-2018-11347The YunoHost 2.7.2 through 2.7.14 web application is affecte…
• CVE-2018-11348Two XSS vulnerabilities are located in the profile edition p…