---
id: CVE-2018-25439
title: MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter
summary: >-
  MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in
  /include/thumb.php that allows unauthenticated attackers to read arbitrary
  files via the dir parameter. Attackers can send crafted requests with
  backslash sequence…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: MetInfo
product: MetInfo
affected:
  - MetInfo >= 6.0.0 < 6.1.1
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T10:57:26.044Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2018-25439'
references:
  - url: 'https://web.archive.org/web/20190916061234/https://paper.seebug.org/676/'
    label: Archived Seebug Paper 676
  - url: >-
      https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/metinfo-lfi.yaml
    label: Nuclei Template
  - url: 'https://www.metinfo.cn/'
    label: Product Webpage
  - url: >-
      https://www.vulncheck.com/advisories/metinfo-cms-6.1.1-unauthenticated-path-traversal-via-thumb-php-dir-parameter
    label: >-
      VulnCheck Advisory: MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via
      thumb.php dir Parameter
tags:
  - cve.org
ingestedAt: '2026-10-22T11:37:02.345Z'
---

## Overview

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

## Affected

- `MetInfo >= 6.0.0 < 6.1.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.