CVE-2015-10136

Published: Jul 19, 2025Modified: Dec 16, 2025

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security@wordfence.com (Secondary)

Description

The GI-Media Library plugin for WordPress is vulnerable to Directory Traversal in versions before 3.0 via the 'fileid' parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected (1)

Products: Zishanj: Gi Media Library

1 product

Gi Media Library

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zishanj Gi Media Library	Before 3.0

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (7)

http://wordpressa.quantika14.com/repository/index.php?id=24

Source: security@wordfence.com

Broken Link

https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb

Source: security@wordfence.com

Product

https://plugins.trac.wordpress.org/changeset/1132677

Source: security@wordfence.com

Patch

https://wordpress.org/plugins/gi-media-library/#developers

Source: security@wordfence.com

Product

https://wpscan.com/vulnerability/7754

Source: security@wordfence.com

Broken Link

https://www.rapid7.com/db/modules/auxiliary/scanner/http/wp_gimedia_library_file_read/

Source: security@wordfence.com

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/2f80c3b9-5148-42eb-9137-9c538184cda3?source=cve

Source: security@wordfence.com

Third Party Advisory

Timeline

No history available yet.