CVE-2016-6614

An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features

published December 11, 2016

CVSS
—
EPSS
2%
Percentile
83.4
In the wild
Unconfirmed
What it is

An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02347 · 83.4th percentile
Published
2016-12-11T02:00Z
EPSS history
Timeline
  • 11 DEC 02:00Z
    An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features
    cvelistv5