CVE-2023-3056

CVE-2023-3056 is a critical path traversal vulnerability affecting YFCMF up to version 3.0.4, specifically within the index.php file. This flaw allows an unauthenticated attacker to remotely manipulate file paths, potentially leading to full compromise of confidentiality, integrity, and availability. With a CVSS score of 9.8 (Critical), it is easily exploitable over the network with low attack complexity and no user interaction. While there is no evidence of active exploitation in the wild or readily available exploit modules like Metasploit, the exploit details have been publicly disclosed, increasing the risk of future attacks.