{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/aspose/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:aspose:pdf_exporter:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2015-20125"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Aspose PDF Exporter (\u003c 2.0)"],"_cs_severities":["high"],"_cs_tags":["web-application","vulnerability","path-traversal"],"_cs_type":"threat","_cs_vendors":["Aspose"],"content_html":"\u003cp\u003eThe Aspose PDF Exporter plugin for WordPress, in versions prior to 2.0, contains a path traversal vulnerability. This security flaw stems from the unsanitized input handled by the 'file' parameter within the 'aspose_pdf_exporter_download.php' script, which utilizes the 'readfile()' PHP function. Unauthenticated remote attackers can exploit this vulnerability by submitting specially crafted GET requests containing directory traversal sequences (e.g., ../) to the affected script. Successful exploitation allows an attacker to bypass file system restrictions and read sensitive files from the underlying server, such as 'wp-config.php', which typically contains database credentials. The Shadowserver Foundation reported observing in-the-wild exploitation of this vulnerability as early as October 2023. Organizations using this plugin must upgrade to version 2.0 or later to remediate the issue.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to the disclosure of sensitive server-side files, including WordPress configuration files containing database credentials. This can result in full database compromise, unauthorized administrative access to the WordPress instance, and further exploitation of the host environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Aspose PDF Exporter plugin to version 2.0 or later immediately to address CVE-2015-20125.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect attempts to access sensitive files using directory traversal sequences against the affected download script.\u003c/li\u003e\n\u003cli\u003eAudit web server access logs for anomalous GET requests targeting 'aspose_pdf_exporter_download.php' with path traversal patterns (e.g., '../').\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T21:53:28Z","date_published":"2026-10-20T21:53:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aspose-pdf-exporter-traversal/","summary":"The Aspose PDF Exporter plugin for WordPress before version 2.0 is vulnerable to path traversal via the file parameter, allowing unauthenticated remote attackers to retrieve arbitrary files like wp-config.php.","title":"Aspose PDF Exporter: Path traversal vulnerability (CVE-2015-20125)","url":"https://feed.craftedsignal.io/briefs/2026-10-aspose-pdf-exporter-traversal/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:aspose:importer_\u0026_exporter:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2015-20124"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Importer \u0026 Exporter (\u003c 3.0)"],"_cs_severities":["high"],"_cs_tags":["wordpress","plugin","path-traversal","web-application"],"_cs_type":"threat","_cs_vendors":["Aspose"],"content_html":"\u003cp\u003eThe Aspose Importer \u0026amp; Exporter plugin for WordPress, in versions prior to 3.0, is vulnerable to a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the underlying server filesystem. The vulnerability exists due to improper sanitization of the 'file' parameter within the 'aspose_import_export_download.php' script. By providing a crafted path containing directory traversal sequences (such as '../'), an attacker can escape the web root and access sensitive system or application files, including 'wp-config.php', which typically contains database credentials and encryption salts. This vulnerability has been subject to active exploitation in the wild, as noted by the Shadowserver Foundation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized disclosure of sensitive server-side files. Access to 'wp-config.php' can lead to full compromise of the WordPress site, including complete database access, which may be leveraged to inject malicious content, create administrative accounts, or extract sensitive user data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Aspose Importer \u0026amp; Exporter plugin to version 3.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for requests containing directory traversal sequences directed at 'aspose_import_export_download.php'.\u003c/li\u003e\n\u003cli\u003ePerform a security audit of site configurations if the plugin was installed and exposed to the internet.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect and alert on exploitation attempts against this endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T21:53:21Z","date_published":"2026-10-20T21:53:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aspose-path-traversal/","summary":"The Aspose Importer \u0026 Exporter WordPress plugin before 3.0 contains a path traversal vulnerability allowing unauthenticated attackers to read sensitive files via the file parameter.","title":"Aspose Importer \u0026 Exporter: Path traversal vulnerability (CVE-2015-20124)","url":"https://feed.craftedsignal.io/briefs/2026-10-aspose-path-traversal/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:aspose:aspose_doc_exporter:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2015-20123"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Aspose Doc Exporter (\u003c 2.0)"],"_cs_severities":["high"],"_cs_tags":["wordpress","path-traversal","web-exploitation"],"_cs_type":"threat","_cs_vendors":["Aspose"],"content_html":"\u003cp\u003eThe Aspose Doc Exporter plugin for WordPress, specifically versions prior to 2.0, contains a path traversal vulnerability originating from improper input sanitization in the \u003ccode\u003ereadfile()\u003c/code\u003e function. The flaw allows unauthenticated remote attackers to bypass directory restrictions and access arbitrary files on the web server. By crafting malicious GET requests to the \u003ccode\u003easpose_doc_exporter_download.php\u003c/code\u003e script and manipulating the \u003ccode\u003efile\u003c/code\u003e parameter, an attacker can traverse the directory structure to retrieve sensitive configuration files, such as \u003ccode\u003ewp-config.php\u003c/code\u003e. Access to this file typically results in the exposure of database credentials, which can lead to full site takeover or further internal network compromise. This vulnerability has been subject to active exploitation in the wild since at least October 2023.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify sites running the vulnerable Aspose Doc Exporter WordPress plugin.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP GET request targeting the \u003ccode\u003easpose_doc_exporter_download.php\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker appends a malicious path traversal string to the \u003ccode\u003efile\u003c/code\u003e parameter (e.g., \u003ccode\u003e../../../wp-config.php\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe web server processes the request and executes the \u003ccode\u003ereadfile()\u003c/code\u003e function with the unsanitized user input.\u003c/li\u003e\n\u003cli\u003eThe application returns the contents of the target system file in the HTTP response body.\u003c/li\u003e\n\u003cli\u003eAttacker parses the response to extract cleartext database credentials or other sensitive configuration data.\u003c/li\u003e\n\u003cli\u003eAttacker uses stolen credentials to access the backend database or authenticates as a high-privileged user.\u003c/li\u003e\n\u003cli\u003eAttacker achieves unauthorized access to the application data or proceeds with further lateral movement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read sensitive server-side files. For WordPress environments, the most common target is \u003ccode\u003ewp-config.php\u003c/code\u003e, which contains hardcoded database host, username, and password information. This exposure enables attackers to modify the database, inject malicious content into the site, or exfiltrate customer data, leading to total site compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Aspose Doc Exporter plugin to version 2.0 or later immediately to apply the vendor-provided patch.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for requests to \u003ccode\u003easpose_doc_exporter_download.php\u003c/code\u003e containing directory traversal patterns like \u003ccode\u003e../\u003c/code\u003e, \u003ccode\u003e..%2f\u003c/code\u003e, or \u003ccode\u003e..%5c\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUse the Sigma rule provided below to detect exploitation attempts targeting this specific endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T21:53:15Z","date_published":"2026-10-20T21:53:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aspose-doc-exporter-traversal/","summary":"The Aspose Doc Exporter WordPress plugin before version 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server.","title":"Aspose Doc Exporter: Path traversal vulnerability (CVE-2015-20123)","url":"https://feed.craftedsignal.io/briefs/2026-10-aspose-doc-exporter-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Aspose","version":"https://jsonfeed.org/version/1.1"}