CVE-2018-16141

CVE-2018-16141 describes an arbitrary file deletion vulnerability in ThinkCMF X2.2.3, specifically within the do_avatar function of the ProfileController. This flaw allows an authenticated user to delete any file on a Windows server by manipulating the imgurl parameter with directory traversal sequences. The vulnerability is rated Medium severity (CVSS 6.5), indicating it can be exploited remotely with low attack complexity and requires only low privileges, leading to high impact on data integrity. While the attack vector is network-based, the impact is limited to file deletion. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has received minimal community discussion or media coverage, suggesting low public awareness and limited attention from threat actors.