Security readout for executives and security teams
Plain-English summary
This is a low-severity path traversal issue in a Thai Online Accounting System through a CKEditor file manager endpoint. An authenticated adjacent-network attacker could read limited files from affected deployments. The public record says exploit details were disclosed, but there is no KEV listing or cited evidence of active exploitation.
Executive priority
Treat this as a targeted hygiene item, not an emergency. Prioritize remediation where the accounting system is still on versions 1.0 through 1.4 and reachable by untrusted or broad internal users.
Technical view
CVE-2018-25094 affects Online Accounting System versions 1.0 through 1.4. The vulnerable processing is in ckeditor/filemanager/browser/default/image.php, where the fid argument can allow traversal outside the intended file directory. CVSS 3.1 is 3.5, requiring adjacent network access and low privileges, with low confidentiality impact only.
Likely exposure
Exposure appears limited to organizations running ระบบบัญชีออนไลน์ Online Accounting System versions 1.0 to 1.4 with the vulnerable CKEditor file manager path deployed and reachable to authenticated adjacent-network users.
Exploitation context
The source bundle says an exploit was publicly disclosed and may be used. It does not provide evidence of active exploitation, and the CVE is not listed as KEV.
Researcher notes
Evidence is sufficient for affected versions, impact class, CVSS, public disclosure, and upgrade target. Details are limited because the record describes the affected processing as unknown and does not cite real-world exploitation telemetry.
Mitigation direction
- Upgrade affected Online Accounting System deployments to version 2.0.0.
- Confirm deployed code includes patch commit 9d9618422b980335bb30be612ea90f4f56cb992c.
- Inventory systems for versions 1.0 through 1.4.
- If upgrade is delayed, check vendor guidance for supported temporary mitigations.
Validation and detection
- Confirm the running application version is 2.0.0 or later.
- Check whether the vulnerable CKEditor file manager path exists in deployed instances.
- Review deployed image.php code against the referenced patch commit.
- Review access logs for suspicious traversal attempts against the affected endpoint.
- Rerun vulnerability scanning after upgrade to confirm CVE-2018-25094 is cleared.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-24: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-25094 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N2.11.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.5LowVector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://vuldb.com/?id.246641CVE reference · vdb-entry, technical-description
- https://vuldb.com/?ctiid.246641CVE reference · signature, permissions-required
- https://github.com/59160781/project/commit/9d9618422b980335bb30be612ea90f4f56cb992cCVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Path Traversal: '../filedir'
Path Traversal: '../filedir' represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.