CVE-2018-16518

A directory traversal vulnerability with remote code execution in Prim'X Zed! FREE through 1.0 build 186 and Zed! Limited Edition through 6.1 build 2208 allows creation of arbitrary files on a user's workstation using crafted ZED! containers because the watermark loading function can place an executable file into a Startup folder.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 86%
VendorProductVersion
primxzed\!
𝑥
≤ 6.1
primxzed\!_free
𝑥
≤ 1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/ponypot/cve/blob/master/zed_watermarkExtension.pdf
https://github.com/ponypot/cve/blob/master/zed_watermarkExtension.pdf