PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-25393 Navigatecms CVE debrief

Navigate CMS 2.8.5 contains a path traversal vulnerability that allows authenticated users to download arbitrary files by injecting directory traversal sequences in the id parameter. Attackers can send GET requests to navigate_download.php with path traversal payloads to access sensitive configuration files and system files outside the intended directory.

Vendor
Navigatecms
Product
Navigate CMS
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-05-29
Advisory published
2026-05-29
Advisory updated
2026-05-29

Who should care

Organizations running Navigate CMS 2.8.5, particularly those with external-facing installations. Security teams responsible for web application security, system administrators managing Navigate CMS deployments, and developers maintaining Navigate CMS installations should prioritize assessment and remediation.

Technical summary

The vulnerability exists in navigate_download.php where the id parameter fails to properly sanitize directory traversal sequences (e.g., ../../../). An authenticated attacker can exploit this to download arbitrary files from the server, including sensitive configuration files such as cfg/globals.php. The attack requires network access and valid authentication credentials. The vulnerability has high impact on confidentiality (VC:H) with no impact on integrity or availability.

Defensive priority

HIGH

Recommended defensive actions

  • Restrict access to navigate_download.php to authorized administrative users only
  • Implement input validation and sanitization on the id parameter to reject path traversal sequences
  • Apply principle of least privilege for Navigate CMS user accounts
  • Monitor for suspicious GET requests to navigate_download.php containing directory traversal patterns
  • Upgrade to a patched version of Navigate CMS when available
  • Review file system permissions to prevent web server access to sensitive configuration files

Evidence notes

The vulnerability is classified as CWE-22 (Path Traversal). CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. The vulnerability requires authenticated access (PR:L), making exploitation conditional on valid credentials. The vulnerability status in NVD is listed as 'Deferred'.

Sources and references

Verified primary and authoritative sources

  • CVE-2018-25393 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2018-25393

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2018-25393 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2018-25393

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.