CVE-2019-15952

CVE-2019-15952 is a high-severity path traversal and remote command execution vulnerability affecting Total.js CMS version 12.0.0. An authenticated user with "Pages" privileges can exploit this by using path traversal to include .html files outside the permitted directory. If these files contain malicious template directives, the server-side processing of these directives can lead to remote command execution. The vulnerability has a CVSS score of 8.8, indicating a network-based attack with low privileges and no user interaction, resulting in high impact to confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.