CVE-2018-7654

On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path traversal.

• CWE-22

• http://www.rootlabs.com.br/path-traversal-in-3cx/Third Party Advisory
• https://medium.com/stolabs/path-traversal-in-3cx-7421a8ffdb7aThird Party Advisory
• http://www.rootlabs.com.br/path-traversal-in-3cx/Third Party Advisory
• https://medium.com/stolabs/path-traversal-in-3cx-7421a8ffdb7aThird Party Advisory

Published

Mar 4, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7648An issue was discovered in mj2/opj_mj2_extract.c in OpenJPEG…9.8
• CVE-2018-7649Monitorix before 3.10.1 allows XSS via CGI variables.
• CVE-2018-7650PHP Scripts Mall Hot Scripts Clone:Script Classified Version…
• CVE-2018-7651index.js in the ssri module before 5.2.2 for Node.js is pron…
• CVE-2018-7652lib/Zonemaster/GUI/Dancer/Export.pm in Zonemaster Web GUI be…6.1
• CVE-2018-7653In YzmCMS 3.6, index.php has XSS via the a, c, or m paramete…
• CVE-2018-7658NTSServerSvc.exe in the server in Softros Network Time Syste…
• CVE-2018-7659In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Stor…
• CVE-2018-7660In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Refl…
• CVE-2018-7661Papenmeier WiFi Baby Monitor Free & Lite before 2.02.2 allow…
• CVE-2018-7662Couch through 2.0 allows remote attackers to discover the fu…
• CVE-2018-7663An issue was discovered in resources/views/layouts/app.blade…