← Database

CVE-2025-2048

MEDIUM CVSS: 4.1 Published: 2025-04-01 Modified: 2026-06-17

Description

The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server

Affected Platforms

Lana Lana Downloads Manager

Weakness Type

CWE-22

References