CVE-2026-117127 Details

A directory traversal vulnerability has been identified in GleezCMS version 1.2.0. This vulnerability allows remote attackers to read arbitrary files on the server by exploiting the 'action_serve' function in 'media.php'. The issue arises because the 'file' parameter is not properly sanitized, enabling attackers to traverse out of the intended 'media/' directory and access sensitive information.

To address this vulnerability, it is recommended to sanitize the 'file' parameter by rejecting or normalizing path traversal sequences before use. Additionally, the media route could be restricted to a known set of public assets rather than serving arbitrary files. Keeping application configuration files outside the web root and not readable by the application user can also help mitigate the risk.