Vulnerability · Published Jan 13, 2026 · Assigned by VulnCheck

CVE-2021-47751CuteEditor for PHP 6.6 - Directory Traversal

High 7.5

In plain English

A high-severity path traversal in CuteEditor from Phphtmledit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.9%top 41.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CuteEditor for PHP (now referred to as Rich Text Editor) 6.6 contains a directory traversal vulnerability in the browse template feature that allows attackers to write files to arbitrary web root directories. Attackers can exploit the ServerMapPath() function by renaming uploaded HTML files using directory traversal sequences to write files outside the intended template directory.

Affected products (as reported)

Vendor	Product	Versions
Phphtmledit	CuteEditor	0 – through 6.6

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

ExploitDB-50994 exploit
Vendor Homepage product
VulnCheck Advisory: CuteEditor for PHP 6.6 - Directory Traversal third-party-advisory