CVE-2024-0221 json
Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename
published 2024-02-05 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-16020
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 70%
- public exploits
- 0
- none known
Summary
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.19 via the rename_item function. This makes it possible for authenticated attackers to rename arbitrary files on the server. This can lead to site takeovers if the wp-config.php file of a site can be renamed. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery management permissions to lower level users, which might make this exploitable by users as low as contributors.
Patch / fix
- 10web photo_gallery 1.8.20
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.30% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected products
- 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- 10web photo_gallery
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
- Technology feeds
References
-
wordfence.com
/threat-intel/vulnerabilities/id/3a3b8f32-f29d-4e67-8fad-202bfc8a9918?source=cve
patch, third-party-advisory
-
plugins.trac.wordpress.org
/changeset?sfp_email=&sfph_mail=&reponame=&new=3022981%40photo-gallery%2Ftrunk&old=3013021%40photo-gallery%2Ft
patch
-
plugins.trac.wordpress.org
/browser/photo-gallery/trunk/filemanager/controller.php#L441
issue-tracking
-
plugins.trac.wordpress.org
/browser/photo-gallery/trunk/filemanager/controller.php#L291
issue-tracking
Sources
- CVE List CVE-2024-0221
- NVD CVE-2024-0221
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.