CVE-2018-16820

admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/…….//./…….//./ requests.

Date published : 2018-09-18

http://blog.51cto.com/13770310/2173957

https://github.com/monstra-cms/monstra/issues/457