{"id":"CVE-2022-23409","details":"The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.","modified":"2026-08-12T03:51:35.345554036Z","published":"2022-01-31T07:04:50Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23409.json","unresolved_ranges":[{"extracted_events":[{"fixed":"3.0.4"}],"source":"DESCRIPTION"}]},"references":[{"type":"WEB","url":"http://packetstormsecurity.com/files/165706/Ethercreative-Logs-3.0.3-Path-Traversal.html"},{"type":"WEB","url":"https://plugins.craftcms.com/logs"},{"type":"WEB","url":"https://sec-consult.com/vulnerability-lab/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23409.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23409"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ethercreative/logs","events":[{"introduced":"0"},{"fixed":"f1bae26f356d7f36a5d12febd39bda1d421fffd0"}],"database_specific":{"cpe":"cpe:2.3:a:ethercreative:logs:*:*:*:*:*:craft_cms:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.0.4"}],"source":"CPE_RANGE"}}],"versions":["3.0.3","3.0.2","3.0.1","v3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23409.json"}}],"schema_version":"1.9.0"}