CVE-2018-16819

admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/…….//./…….//./&delete_file= requests.

Date published : 2018-09-18

http://blog.51cto.com/13770310/2173956

https://github.com/monstra-cms/monstra/issues/456