Croogo CMS Path Traversal Vulnerability in Admin File Manager Component

A path traversal vulnerability has been identified in Croogo CMS versions prior to 4.0.7. The issue arises in the Admin File Manager component, specifically within the FileManager::isEditable function of FileManager/src/Utility/FileManager.php. The vulnerability allows authenticated users to manipulate file paths, potentially leading to arbitrary file writes and, if the files are executed via PHP, remote code execution.

Impact

Exploitation of this vulnerability allows authenticated users to write files outside of designated editable directories, with the potential for executing malicious PHP code if the files are placed in a web-accessible, PHP-executable location.

Reproduction

To reproduce this vulnerability, an authenticated admin user can use the FileManager component to create or edit files. The path validation incorrectly allows writing files outside the intended editable directories. This can be done by sending a request to the 'create-file' or 'edit-file' endpoints with a path that traverses outside the allowed directory.