Login Request a demo
High severity · published Mar 6, 2026
CVE-2018-25178
Easyndexer 1.0 Arbitrary File Download via showtif.php
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Easyndexer 1.0 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the file parameter. Attackers can send POST requests to showtif.php with arbitrary file paths in the file parameter to retrieve system files like configuration and initialization files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Easyndexer · Sourceforge
1.0 · source: vendor, NVD
Affected product
EA
Easyndexer
Sourceforge
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-25178
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-25178
Exploit
https://www.exploit-db.com/exploits/45835
Broken Link
https://www.vulncheck.com/advisories/easyndexer-arbitrary-file-download-via-showtifphp
More from Easyndexer
6.5
CVE-2018-25190
Easyndexer 1.0 Cross-Site Request Forgery via createuser.php