Skip to content
Fencer Vulns
medium 4.0

CVE-2007-5320 json

Multiple absolute path traversal vulnerabilities in Pegasus Imaging ImagXpress 8.0 allow remote attackers to (1) delete arbitrary files via…

published 2007-10-09 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-5300

cvss
4.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
6.5%
EPSS 6.5% chance of exploitation in 30 days, percentile 93%
public exploits
1
Exploit-DB

Summary

Multiple absolute path traversal vulnerabilities in Pegasus Imaging ImagXpress 8.0 allow remote attackers to (1) delete arbitrary files via the CacheFile attribute in the ThumbnailXpres.1 ActiveX control (PegasusImaging.ActiveX.ThumnailXpress1.dll) or (2) overwrite arbitrary files via the CompactFile function in the ImagXpress.8 ActiveX control (PegasusImaging.ActiveX.ImagXpress8.dll).

Timeline

  1. First public exploit (EDB-4488)
  2. Published

Exploit prediction

6.51% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-4488 Pegasus Imaging ImagXpress 8.0 - Arbitrary File Overwrite remote, 2007-10-05
  • securityfocus.com http://www.securityfocus.com/bid/25948 referenced PoC, tagged "exploit" by a source, unverified
  • shinnai.altervista.org http://shinnai.altervista.org/exploits/txt/TXT_3DQ1nIkI6zmWCek4zP5U.html referenced PoC, tagged "exploit" by a source, unverified
  • shinnai.altervista.org http://shinnai.altervista.org/exploits/txt/TXT_wfv7ZG0G6KnQlk1SieLd.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 4.0 AV:N/AC:H/Au:N/C:N/I:P/A:P

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.